Archive

Articles taggués ‘routage’

IP leak affecting VPN providers with port forwarding

20/09/2023 Aucun commentaire

Vulnerability “Port Fail” reveals real IP address

We have discovered a vulnerability in a number of providers that allows an attacker to expose the real IP address of a victim. “Port Fail” affects VPN providers that offer port forwarding and have no protection against this specific attack. Perfect Privacy users are protected from this attack.

This IP leak affects all users: The victim does not need to use port forwarding, only the attacker has to set it up.

We have tested this with nine prominent VPN providers that offer port forwarding. Five of those were vulnerable to the attack and have been notified in advance so they could fix this issue before publication. However, other VPN providers may be vulnerable to this attack as we could not possibly test all existing VPN providers.

Details about the leak

The attacker needs to meet the following requirements:

  • Has an active account at the same VPN provider as the victim
  • Knows victim’s VPN exit IP address (can be obtained by various means, e.g. IRC or torrent client or by making the victim visit a website under the attackers control)
  • The attacker sets up port forwarding. It makes no difference whether the victim has port forwarding activated or not.

The IP leak can then be triggered as follows:

  1. Victim is connected to VPN server 1.2.3.4
  2. Victim’s routing table will look something like this:
    0.0.0.0/0 -> 10.0.0.1 (internal vpn gateway ip)
    1.2.3.4/32 -> 192.168.0.1 (old default gateway)
  3. Attacker connects to same server 1.2.3.4 (knows victim’s exit through IRC or other means)
  4. Attacker activates Port Forwarding on server 1.2.3.4, example port 12345
  5. Attacker gets the victim to visit 1.2.3.4:12345 (for example via embedding <img src=”http://1.2.3.4:12345/x.jpg”> on a website)
  6. This connection will reveal the victim’s real IP to the attacker because of the “1.2.3.4/32 -> 192.168.0.1” vpn route.

The crucial issue here is that a VPN user connecting to his own VPN server will use his default route with his real IP address, as this is required for the VPN connection to work. If another user (the attacker) has port forwarding activated for his account on the same server, he can find out the real IP addresses of any user on the same VPN server by tricking him into visiting a link that redirects the traffic to a port under his control.

Also note that due to the nature of this attack all VPN protocols (IPSec, OpenVPN, PPTP, etc.) and all operating systems are affected.

Mitigation

Affected VPN providers should implement one of the following:

  • Have multiple IP addresses, allow incoming connections to ip1, exit connections through ip2-ipx, have portforwardings on ip2-ipx
  • On Client connect set server side firewall rule to block access from Client real ip to portforwardings that are not his own.

 

Source: Perfect Privacy

Categories: Réseau Tags: , ,

Postrouting and IP Masquerading in Linux

10/08/2023 Comments off

postrouting masqueradingIPTables is responsible to handle packet filtering in Linux system. IPTables contains several predefined and/or user-defined tables. Each table contains chains and chain contain packet rules. IPTables uses NAT table to forward packets to another node.

What is POSTROUTING?

A Postrouting chain in NAT table means altering the IP packet after the routing is completed. Logically, a postrouting can be used to change the Source Address. As the routing is completed and destination has his own address, the only unknown address that can be masked is the Source. This is why postrouting is used for SNAT.

What is IP MASQUERADING?

Now, when a packet leaves the local network and tries to travel the public network, it will fail to traverse if it keeps using the local details. This is where IP Masquerading plays the role. IP Masquerading is masking the packet with identity of the external interface.

How POSTROUTING and MASQUERADING relates?

When a packet arrives to the local gateway that has external interface, masks the packet with IP Masquerading and send it through the public interface. That says, packet has to be routed first before mangling it for Masquerading. That is why, you need to apply the Masquerading target on the Postrouting chain of the NAT table.

How to setup Masquerading in Linux Firewall?

The following command will enable IP Masquerading in Linux Firewall:

$ iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

The above rule will use NAT table (-t nat) on built-in Postrouting Chain (-A POSTROUTING) on interface eth0 (-o eth0).

The target Masquerade (-j MASQUERADE) advises to mask the above matched IP packets from the related table to external interface of the system.

Thus the above, would allow the local networks to gain access to external network through IP Masquerading.

 

Source: Mellowhost

Munin: Monitoring the “unreachable” hosts

08/08/2023 Comments off

Source: munin-monitoring.org
There are a number of situations where you’d like to run munin-node on hosts not directly available to the Munin server. This article describes a few scenarios and different alternatives to set up monitoring. Monitoring hosts behind a non-routing server.

In this scenario, a *nix server sits between the Munin server and one or more Munin nodes. The server in-between reaches both the Munin server and the Munin node, but the Munin server does not reach the Munin node or vice versa.

To enable for Munin monitoring, there are several approaches, but mainly either using SSH tunneling or “bouncing” via the in-between server.

SSH tunneling

The illustration below shows the principle. By using SSH tunneling only one SSH connection is required, even if you need to reach several hosts on “the other side”. The Munin server listens to different ports on the localhost interface. A configuration example is included. Note that there is also a FAQ entry on using SSH that contains very useful information.

MuninSSHForwarding

Bouncing

This workaround uses netcat and inetd/xinetd to forward the queries from the Munin server. All incoming connections to defined ports are automatically forwarded to the Munin node using netcat.

MuninPortForwarding

 

Arethusa le test

12/07/2023 Comments off

Un nouveau test VPN publié par le blog du VPN. Ici les VPN sont testés , configurés par créer une base de données la plus fiable possible. Arethusa à ses adeptes, il a déjà été l’ objet d’ une publication par alipaxe. Comme toujours on essayera d’ insister sur les particularités: méthode de configuration – protocole rare – tutos techniques.

Arethusa est proposé par S6N.org: une organisation internationale à but non lucratif fondée en 2003, pour promouvoir liberté d’expression sur Internet. La juridiction dont dépend ce VPN est celle des îles Seychelles: « Applicable jurisdiction for the handling of personal data is the Republic of Seychelles. Only Seychelles authorities can ask us to reveal your personal details. The only details we have about you are the ones you entered yourself. » Le whois de S6N.org confirme l’ enregistrement de nom de domaine de  l’ organisation à Victoria, capitale de cette République. Bien que le site soit en Anglais, le support technique et l’ interface sont en français. Lire la suite…

Configurer une Freebox pour autoriser une connexion VPN à un routeur DD-WRT

27/06/2023 Comments off

Source: Autour de… Sam

Autour de… Sam
freebox-revolutionLa question revient assez souvent pour se connecter à distance chez soi au travers un VPN quand on dispose d’un routeur sous DD-Wrt derrière une box ADSL.
Dans le cas que vais expliquer ci-dessous, je prendrai le cas d’une Freebox V4 et d’une Freebox V6.

Il faut tout d’abord savoir que DD-Wrt embarque un très bon parefeu et que nos box ADSL françaises sont aussi équipées d’un parefeu quand elles sont en mode routeur et non pas en mode passerelle (gateway ou bridge). Lire la suite…

Categories: Réseau, Système Tags: ,