11–20 of 86 posts
For anybody that's tried both - how do these compare to DNS tunnels (e.g. iodine), in terms of speed and reliability?
Although I'm interested in comparison as well :)
Earlier quoted context omitted.
I agree that some captive portals/firewalls do block ICMP but still I've seen many in my country which don't.
Well the question is then what's the point other than a personal exercise? There is plenty of ICMP / multi protocol tunnels software out there for both linux and windows much of it doesn't require administrative privileges. Also ptunnel comes standard with some linux distro's these days Ubuntu and so do probably most of it's derivatives, and as far as raw performance goes ptunnel is also the highest performing one ca…
I use to restrict ICMP to echo/reply using -m icmp on iptables, but this uses just that kind of packets... Is there anyway to stop things like this at the corporate firewall?
Big corporate places can completely restrict things and prevent any traffic from internal hosts to the internet. You can use proxying for web browsing etc. and then monitor that to check for any unauthorised traffic.
I use to restrict ICMP to echo/reply using -m icmp on iptables, but this uses just that kind of packets... Is there anyway to stop things like this at the corporate firewall?
Yes. In my opinion they should restrict the payload size of an ICMP message. Blocking all echo/reply can have adverse impact on other applications as well.
I just tried iodine and icmptunnel. Can't say for sure but I think icmptunnel was faster. At least for my internet
I use to restrict ICMP to echo/reply using -m icmp on iptables, but this uses just that kind of packets... Is there anyway to stop things like this at the corporate firewall?
Yes. In my opinion they should restrict the payload size of an ICMP message. Blocking all echo/reply can have adverse impact on other applications as well.
# iptables -A FORWARD -p icmp --icmp-type echo-request -m length --length 86:0xffff -j DROP
Update: as for the number of packets, there is -m limit and other recipes.
Earlier quoted context omitted.
Yes. In my opinion they should restrict the payload size of an ICMP message. Blocking all echo/reply can have adverse impact on other applications as well.
OK, I see "length" extension in man iptables-extensions (Debian 8), so for example, to drop pings with a packet size greater than 85 bytes: # iptables -A FORWARD -p icmp --icmp-type echo-request -m length --length 86:0xffff -j DROP Still, until someone checks the code of this tool, or a working test environment, we won't know if the rule stops this tool. Update: as for the number of packets, there is -m limit and oth…
Also, instead of using the plain limit match, check out hashlimit. It can apply a rate limit on a per sender, destination, or sender+destination basis. The recent match may also be of interest.
I just tried iodine and icmptunnel. Can't say for sure but I think icmptunnel was faster. At least for my internet
That's good news for me. :)
Having said that, I'm sure there are other usage for such a tool :).
I just tried iodine and icmptunnel. Can't say for sure but I think icmptunnel was faster. At least for my internet