Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How does Linux NAT a ping?

devnonsense.com

Post reply on HN
Print view View original

31–40 of 108 posts

Re: How does Linux NAT a ping?

#31

Post by freedomben »

zackmorris wrote: post #23

I wonder if ping could be abused to send short messages for p2p networking over UDP without a central server to handle NAT busting. Looks like someone figured the message part out: https://stackoverflow.com/questions/31857419/how-to-send-a-m... Unfortunately ping is handled by the OS so apps on the peer IPs wouldn't be able to read the messages. I wonder if it's time to provide hooks to some of these services in user…

Minor technical correction, but ping is ICMP rather than UDP.

But I have seen data exfiltration strategies and other communication that uses ping! Nowadays I think it would be nearly impossible for p2p because most firewall default configs will silently drop all ICMP, including pings.

Re: How does Linux NAT a ping?

#32

Post by toast0 »

growse wrote: post #15
midasuni wrote: post #12

Earlier quoted context omitted.

Many ISPs suck. That’s not controversial. We have to deal with the world we live in, not the world we’d like.

> Many ISPs suck. That’s not controversial. > We have to deal with the world we live in, not the world we’d like. No we don't. Some choose to just put up with shittiness, others enact change.

Priorities. I don't have to put up with PPPoE in 2023, but it's a hell of a lot less expensive than pulling munifiber to my garage (and the monthly fees for munifiber are higher too, so there's no point in time where it makes economic sense), and consistency and stable addressing is currently winning over the promise of 5g/leo satellite.

Re: How does Linux NAT a ping?

#33

Post by dmatech »

noinsight wrote: post #29
midasuni wrote: post #11

Earlier quoted context omitted.

I have a few devices on my home internet, on a handful of 192.168 subnets The other week I moved my ISP. The AS my house belonged to obviously changed to the new ISP, and I got a new v4 IP All I had to do was update my Wan router to forward trafffic from the new Ip. Instead with ipv6 I would have to change every node on my network, update my internal DNS. Now in theory I could have my own /48 which I take with me. Th…

You could be using IPv6 ULA addresses internally on your home network to have static addressing. The real solution is moving to DNS names though with your router maintaining them based on DHCP leases or just using multicast DNS (Zeroconf). In the future you can probably go "IPv6-mostly" with a CLAT engine to ditch dual-stack: https://blog.apnic.net/2022/11/21/deploying-ipv6-mostly-acce...

You could, but now you have three addresses per node instead of one. Plus, the mechanisms for assigning those addresses are weird compared to DHCP and static assignment. I get that it facilitates packets being routed reliably, but some of us want maintainable firewall rules that don't have to deal with IP addresses changing out of the blue.

Re: How does Linux NAT a ping?

#34

Post by voxic11 »

You might be interested in https://samy.pl/pwnat/

    Specifically, when the server starts up, it begins sending fixed ICMP echo
    request packets to the fixed address 3.3.3.3. We expect that these packets
    won't be returned.

    Now, 3.3.3.3 is *not* a host we have any access to, nor will we end up spoofing
    it. Instead, when a client wants to connect, the client (which knows the server
    IP address) sends an ICMP Time Exceeded packet to the server. The ICMP packet 
    includes the "original" fixed packet that the server was sending to 3.3.3.3.
    The packet is INSIDE the computer. This harcoded packet is built into pwnat
    and acts as an identifier for pwnat.

    Why? Well, the client is  pretending to be a hop on the Internet, politely
    telling the server that its original "ICMP echo request" packet couldn't be
    delivered. Your NAT, being the gapingly open device it is, is nice enough to
    notice that the packet *inside* the ICMP time exceeded packet matches the
    packet the server sent out. Your NAT then forwards the ICMP time exceeded
    back to the server behind the NAT, *including* the full IP header from the
    client, thus allowing the server to know what the client IP address is!

Re: How does Linux NAT a ping?

#35

Post by starfallg »

baq wrote: post #22
Beinglis23 wrote: post #21

When a ping is sent from a device on a local network to a device on the internet, the router performing NAT rewrites the source address of the ping to its public IP address and rewrites the ID field of the ICMP packet to a unique value. When the response is received, the router uses the unique ID value to forward the response to the correct device on the local network.

Taking this thought just a tiny bit further, this is changing a stateless protocol to a stateful one.

Any NAT that is not statically mapping IP addresses or ports 1-to-1 will require connections to be tracked and hence makes it stateful on the side after the translation (usually outside).

Hence you do need state syncing between firewalls in order for NAT connections to failover correctly, unless it's a statically mapped, one-on-one, one range onto another range, for example.

Re: How does Linux NAT a ping?

#36

Post by lazide »

freedomben wrote: post #31
zackmorris wrote: post #23

I wonder if ping could be abused to send short messages for p2p networking over UDP without a central server to handle NAT busting. Looks like someone figured the message part out: https://stackoverflow.com/questions/31857419/how-to-send-a-m... Unfortunately ping is handled by the OS so apps on the peer IPs wouldn't be able to read the messages. I wonder if it's time to provide hooks to some of these services in user…

Minor technical correction, but ping is ICMP rather than UDP. But I have seen data exfiltration strategies and other communication that uses ping! Nowadays I think it would be nearly impossible for p2p because most firewall default configs will silently drop all ICMP, including pings.

Nod, I remember it not being as effective/easy to hide as exfiltration over UDP/DNS too, as there was always less background noise to hide in. That said, I found this with a quick search - https://github.com/utoni/ptunnel-ng for those who still want to do it. A number of hotels and captive portals still let pings through relatively unmolested even if they play tricks with UDP/TCP.

Any significant data over ICMP will always stick out though if anyone is doing analysis. Which isn’t often, frankly, in situations like I described, but…

Re: How does Linux NAT a ping?

#37

Post by jandrese »

freedomben wrote: post #31
zackmorris wrote: post #23

I wonder if ping could be abused to send short messages for p2p networking over UDP without a central server to handle NAT busting. Looks like someone figured the message part out: https://stackoverflow.com/questions/31857419/how-to-send-a-m... Unfortunately ping is handled by the OS so apps on the peer IPs wouldn't be able to read the messages. I wonder if it's time to provide hooks to some of these services in user…

Minor technical correction, but ping is ICMP rather than UDP. But I have seen data exfiltration strategies and other communication that uses ping! Nowadays I think it would be nearly impossible for p2p because most firewall default configs will silently drop all ICMP, including pings.

Note that blanket dropping of ICMP will break Path MTU Discovery (PMTUD) so you had better not be tunneling or encapsulating TCP traffic.

Re: How does Linux NAT a ping?

#38

Post by throwawaymaths »

throwawaymaths wrote: post #27
riffic wrote: post #25

Earlier quoted context omitted.

ping is icmp not udp

It's super confusing because you can use udp to read icmp packets (but not send, iirc), and i might be wrong, but i remember seeing tuts that did this!!

Getting downvoted, so:

https://stackoverflow.com/questions/13087097/how-to-get-icmp...

Using a udp socket is the "classic" way of implementing ping on low privilege syystems

Re: How does Linux NAT a ping?

#39

Post by jandrese »

midasuni wrote: post #11
jjoonathan wrote: post #2

NAT is such a trashy abstraction. IPv4 needs to die.

I have a few devices on my home internet, on a handful of 192.168 subnets The other week I moved my ISP. The AS my house belonged to obviously changed to the new ISP, and I got a new v4 IP All I had to do was update my Wan router to forward trafffic from the new Ip. Instead with ipv6 I would have to change every node on my network, update my internal DNS. Now in theory I could have my own /48 which I take with me. Th…

With IPv6 you would do stateless autoconfigurarion, so there would be no manually setting of your addresses. The router would advertise the new prefix and everything would just use it.

There would be no DNS configuration at all, all local machines would use anycast DNS for the services and a well known server for Internet addresses.

One of the primary goals of IPv6 was to avoid needing manual configuration if anything on the network. It is supposed to be as automated as possible.

Re: How does Linux NAT a ping?

#40

Post by jandrese »

mindslight wrote: post #17
jjoonathan wrote: post #2

NAT is such a trashy abstraction. IPv4 needs to die.

Is there a better way to not unnecessarily leak addressing metadata to adversarial remote nodes and middle boxes? IPv6 with assigning end users a whole /64 and end-devices continually churning through privacy addresses is a start. But even then some form of NAT is still required to nimbly use source prefixes from different horizon providers - eg to avoid spilling your geographic location or opening yourself up to low…

Why not just use a VPN in both cases? That’s more or less what your NAT solution is doing, except without the encryption to the data center.
Post reply on HN