From 5ef3fb9e97e8627d69c1114a8f910833db2a077b Mon Sep 17 00:00:00 2001 From: bol-van Date: Sat, 9 Mar 2024 12:45:17 +0300 Subject: [PATCH] BSD use SYN,ACK filter to catch autottl --- blockcheck.sh | 4 ++-- docs/bsd.eng.md | 18 ++++++++++++------ docs/bsd.txt | 19 +++++++++++++------ docs/bsdfw.txt | 6 ++++-- 4 files changed, 31 insertions(+), 16 deletions(-) diff --git a/blockcheck.sh b/blockcheck.sh index bf02bd3..9cb333d 100755 --- a/blockcheck.sh +++ b/blockcheck.sh @@ -364,8 +364,8 @@ pktws_ipt_prepare() ;; ipfw) IPFW_ADD divert $IPFW_DIVERT_PORT tcp from me to any $1 proto ip${IPV} out not diverted not sockarg - # this redirects all incoming traffic to the port, do not use it in real life ! - IPFW_ADD divert $IPFW_DIVERT_PORT tcp from any $1 to me proto ip${IPV} in not diverted not sockarg + # for autottl mode + IPFW_ADD divert $IPFW_DIVERT_PORT tcp from any $1 to me proto ip${IPV} tcpflags syn,ack in ;; esac } diff --git a/docs/bsd.eng.md b/docs/bsd.eng.md index e6a2503..4cd8dca 100644 --- a/docs/bsd.eng.md +++ b/docs/bsd.eng.md @@ -155,6 +155,8 @@ For all traffic: ``` ipfw delete 100 ipfw add 100 divert 989 tcp from any to any 80,443 out not diverted not sockarg xmit em0 +# required for autottl mode only +ipfw add 100 divert 989 tcp from any 80,443 to any tcpflags syn,ack in recv em0 /opt/zapret/nfq/dvtws --port=989 --dpi-desync=split2 ``` @@ -163,6 +165,8 @@ Process only table zapret with the exception of table nozapret: ipfw delete 100 ipfw add 100 allow tcp from me to table\(nozapret\) 80,443 ipfw add 100 divert 989 tcp from any to table\(zapret\) 80,443 out not diverted not sockarg xmit em0 +# required for autottl mode only +ipfw add 100 divert 989 tcp from table\(zapret\) 80,443 to any tcpflags syn,ack in recv em0 /opt/zapret/nfq/dvtws --port=989 --dpi-desync=split2 ``` @@ -349,17 +353,19 @@ table file "/opt/zapret/ipset/zapret-ip.txt" table file "/opt/zapret/ipset/zapret-ip-user.txt" table file "/opt/zapret/ipset/zapret-ip-exclude.txt" pass out quick on em0 inet proto tcp to port {80,443} -pass in quick on em0 inet proto tcp from port {80,443} no state -pass out quick on em0 inet proto tcp to port {80,443} divert-packet port 989 no state -pass in quick on em0 inet proto tcp from port {80,443} no state -pass out quick on em0 inet proto tcp to port {80,443} divert-packet port 989 no state +pass in quick on em0 inet proto tcp from port {80,443} flags SA/SA divert-packet port 989 no state +pass in quick on em0 inet proto tcp from port {80,443} no state +pass out quick on em0 inet proto tcp to port {80,443} divert-packet port 989 no state +pass in quick on em0 inet proto tcp from port {80,443} no state +pass out quick on em0 inet proto tcp to port {80,443} divert-packet port 989 no state table file "/opt/zapret/ipset/zapret-ip6.txt" table file "/opt/zapret/ipset/zapret-ip-user6.txt" table file "/opt/zapret/ipset/zapret-ip-exclude6.txt" pass out quick on em0 inet6 proto tcp to port {80,443} -pass in quick on em0 inet6 proto tcp from port {80,443} no state +pass in quick on em0 inet6 proto tcp from port {80,443} flags SA/SA divert-packet port 989 no state +pass in quick on em0 inet6 proto tcp from port {80,443} no state pass out quick on em0 inet6 proto tcp to port {80,443} divert-packet port 989 no state -pass in quick on em0 inet6 proto tcp from port {80,443} no state +pass in quick on em0 inet6 proto tcp from port {80,443} no state pass out quick on em0 inet6 proto tcp to port {80,443} divert-packet port 989 no state ``` diff --git a/docs/bsd.txt b/docs/bsd.txt index 021513d..1053801 100644 --- a/docs/bsd.txt +++ b/docs/bsd.txt @@ -123,12 +123,16 @@ ipfw add 100 fwd ::1,988 tcp from any to any 80,443 proto ip6 recv em1 Для всего трафика : ipfw delete 100 ipfw add 100 divert 989 tcp from any to any 80,443 out not diverted not sockarg xmit em0 +# required for autottl mode only +ipfw add 100 divert 989 tcp from any 80,443 to any tcpflags syn,ack in recv em0 /opt/zapret/nfq/dvtws --port=989 ---dpi-desync=split2 Для трафика только на таблицу zapret, за исключением таблицы nozapret : ipfw delete 100 ipfw add 100 allow tcp from me to table\(nozapret\) 80,443 ipfw add 100 divert 989 tcp from any to table\(zapret\) 80,443 out not diverted not sockarg xmit em0 +# required for autottl mode only +ipfw add 100 divert 989 tcp from table\(zapret\) 80,443 to any tcpflags syn,ack in recv em0 /opt/zapret/nfq/dvtws --port=989 --dpi-desync=split2 Недопущение зацикливания - повторного вхождения фейк пакетов на обработку. @@ -282,6 +286,7 @@ dvtws для всего трафика : /etc/pf.conf ------------ +pass in quick on em0 proto tcp from port {80,443} flags SA/SA divert-packet port 989 no state pass in quick on em0 proto tcp from port {80,443} no state pass out quick on em0 proto tcp to port {80,443} divert-packet port 989 no state ------------ @@ -297,17 +302,19 @@ table file "/opt/zapret/ipset/zapret-ip.txt" table file "/opt/zapret/ipset/zapret-ip-user.txt" table file "/opt/zapret/ipset/zapret-ip-exclude.txt" pass out quick on em0 inet proto tcp to port {80,443} -pass in quick on em0 inet proto tcp from port {80,443} no state -pass out quick on em0 inet proto tcp to port {80,443} divert-packet port 989 no state -pass in quick on em0 inet proto tcp from port {80,443} no state -pass out quick on em0 inet proto tcp to port {80,443} divert-packet port 989 no state +pass in quick on em0 inet proto tcp from port {80,443} flags SA/SA divert-packet port 989 no state +pass in quick on em0 inet proto tcp from port {80,443} no state +pass out quick on em0 inet proto tcp to port {80,443} divert-packet port 989 no state +pass in quick on em0 inet proto tcp from port {80,443} no state +pass out quick on em0 inet proto tcp to port {80,443} divert-packet port 989 no state table file "/opt/zapret/ipset/zapret-ip6.txt" table file "/opt/zapret/ipset/zapret-ip-user6.txt" table file "/opt/zapret/ipset/zapret-ip-exclude6.txt" pass out quick on em0 inet6 proto tcp to port {80,443} -pass in quick on em0 inet6 proto tcp from port {80,443} no state +pass in quick on em0 inet6 proto tcp from port {80,443} flags SA/SA divert-packet port 989 no state +pass in quick on em0 inet6 proto tcp from port {80,443} no state pass out quick on em0 inet6 proto tcp to port {80,443} divert-packet port 989 no state -pass in quick on em0 inet6 proto tcp from port {80,443} no state +pass in quick on em0 inet6 proto tcp from port {80,443} no state pass out quick on em0 inet6 proto tcp to port {80,443} divert-packet port 989 no state ------------ pfctl -f /etc/pf.conf diff --git a/docs/bsdfw.txt b/docs/bsdfw.txt index 87e207c..21b55c4 100644 --- a/docs/bsdfw.txt +++ b/docs/bsdfw.txt @@ -27,9 +27,10 @@ ipfw add 100 fwd ::1,988 tcp from any to any 80,443 proto ip6 recv em1 ipfw delete 100 ipfw add 100 divert 989 tcp from any to any 80,443 out not diverted not sockarg xmit em0 +; required for autottl mode +ipfw add 100 divert 989 tcp from any 80,443 to any tcpflags syn,ack in recv em0 +; udp ipfw add 100 divert 989 udp from any to any 443 out not diverted not sockarg xmit em0 -# this is required for autottl but very bad, all incoming traffic will be diverted, no way to limit like in linux (connbytes) -ipfw add 100 divert 989 tcp from any 80,443 to any in not diverted not sockarg recv em0 ipfw delete 100 ipfw add 100 allow tcp from me to table\(nozapret\) 80,443 @@ -71,6 +72,7 @@ pfctl -f /etc/pf.conf ; dvtws works both for routed and local +pass in quick on em0 proto tcp from port {80,443} flags SA/SA divert-packet port 989 no state pass in quick on em0 proto tcp from port {80,443} no state pass out quick on em0 proto tcp to port {80,443} divert-packet port 989 no state pfctl -f /etc/pf.conf