Iptables ttl

Post new topic   Reply to topic    DD-WRT Forum Index -> Atheros WiSOC based Hardware
Goto page 1, 2  Next
Author Message
Itsyaboy
DD-WRT User


Joined: 18 May 2016
Posts: 61

PostPosted: Fri May 27, 2022 17:22    Post subject: Iptables ttl Reply with quote
So I’m trying to modify the ttl on my archer c7 and when I enter these commands

iptables -t mangle -I POSTROUTING -o $(get_wanface) -j TTL --ttl-set 65
iptables -t mangle -I PREROUTING -i $(get_wanface) -j TTL --ttl-set 65

nothing seems to be happening, I tried running as custom command & saving as firewall, also when I enter “iptables -t mangle -vnL POSTROUTING” after nothing is changing, I’m using my router as a repeater and I’m trying to add these firewall settings to hide my mobile hotspot tether usage, any help would be appreciated. Wiki page https://wiki.dd-wrt.com/wiki/index.php/Iptables#Modifying_the_TTL
Sponsor
the-joker
DD-WRT Developer/Maintainer


Joined: 31 Jul 2021
Posts: 1901
Location: All over YOUR webs

PostPosted: Fri May 27, 2022 17:51    Post subject: Reply with quote
A lower/higher TTL is not going to hide any mobile devices tether usage.

TTL aka Time To Live is a setting that determines how long data (in packet form) is valid and available from within a network before the router clears it.

Usually its used as response to e.g. DDoS attacks and not to hide any type of usage. Never heard of it, if for instance someone was already looking at your incoming/outgoing traffic, it wont protect you or hide anything.

Tunneling via SSH, VPN, Proxy may actually hide something but TTL wont.

_________________
Saving your retinas from the burn!🔥
DD-WRT Inspired themes for routers
DD-WRT Inspired themes for the phpBB Forum
DD-WRT Inspired themes for the SVN Trac & FTP site
Join in for a chat @ #style_it_themes_public:matrix.org or #style_it_themes:discord

DD-WRT UI Themes Bug Reporting and Discussion thread

Router: ANus RT-AC68U E1 (recognized as C1)
Itsyaboy
DD-WRT User


Joined: 18 May 2016
Posts: 61

PostPosted: Fri May 27, 2022 18:01    Post subject: Reply with quote
the-joker wrote:
A lower/higher TTL is not going to hide any mobile devices tether usage.

TTL aka Time To Live is a setting that determines how long data (in packet form) is valid and available from within a network before the router clears it.

Usually its used as response to e.g. DDoS attacks and not to hide any type of usage. Never heard of it, if for instance someone was already looking at your incoming/outgoing traffic, it wont protect you or hide anything.


Actually you can, example 3 even says so, also when I tether to my Mac or other iOS devices even some android devices my carrier isn't able to notice that I’m tethering, I can tell because after using all my allowed data those devices don’t get throttled but when I connect my Xbox it does get throttled, people have changed their ttl settings on windows pc & android devices etc to get this to work, this guy here explains it the best https://forums.macrumors.com/threads/ttl-modification-to-cloak-tethered-packets-lets-make-them-work-harder-to-catch-us.1140306/
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 10403
Location: Netherlands

PostPosted: Fri May 27, 2022 18:26    Post subject: Reply with quote
You need this rule:
Code:
iptables -t mangle -I POSTROUTING -o $(get_wanface) -j TTL --ttl-set 128

instead of 128 you can also try 65 or use:
-j TTL --ttl-inc 1

Note that -I is a capital i

Set this rule from the CLI (telnet/Putty) and check with:
iptables -vnL -t mangle

It is possible that the module with TTL is not compiled in as your router has only 16 MB flash

_________________
Routers:Netgear R7800, R7000, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 12990
Location: Texas, USA

PostPosted: Fri May 27, 2022 22:22    Post subject: Reply with quote
How are you determining that "nothing is happening"?
_________________
"Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT
Pogo - A minimal level of ability is expected and needed...
At some point, people just get plain tired of this place.
Because they are tired of bottom-feeders and the same old hat.

----------------------
Linux User #377467 counter.li.org / linuxcounter.net
Itsyaboy
DD-WRT User


Joined: 18 May 2016
Posts: 61

PostPosted: Sat May 28, 2022 17:42    Post subject: Reply with quote
egc wrote:
You need this rule:
Code:
iptables -t mangle -I POSTROUTING -o $(get_wanface) -j TTL --ttl-set 128

instead of 128 you can also try 65 or use:
-j TTL --ttl-inc 1

Note that -I is a capital i

Set this rule from the CLI (telnet/Putty) and check with:
iptables -vnL -t mangle

It is possible that the module with TTL is not compiled in as your router has only 16 MB flash


Thanks, Yea I’ve tried that but it doesn’t seem to change anything, is there any way to find out if it’s a problem with the module u mentioned? So I ended up updating ddwrt and iptables is now V1.8.5 and I’m getting unknown option for —ttl-set & —ttl-inc, when i look at —help for the v1.3.7 and V1.8.5 I don’t see anything for —ttl-set but it didn’t get that error on the earlier version.


Last edited by Itsyaboy on Sat May 28, 2022 17:48; edited 2 times in total
Itsyaboy
DD-WRT User


Joined: 18 May 2016
Posts: 61

PostPosted: Sat May 28, 2022 17:44    Post subject: Reply with quote
kernel-panic69 wrote:
How are you determining that "nothing is happening"?


When I run “iptables -t mangle -vnL POSTROUTING” nothing seems to be changing
thommy181
DD-WRT User


Joined: 16 Mar 2019
Posts: 303
Location: Szczecin, Poland EU

PostPosted: Sat May 28, 2022 18:36    Post subject: Reply with quote
I'm use that two instructions
iptables -t mangle -I POSTROUTING 1 -o vlan2 -j TTL --ttl-set 65
iptables -t mangle -I PREROUTING 1 -i vlan2 -j TTL --ttl-set 65
Sometimes you shouldn't see changes when you test this configuration on windows systems. That working for only vlan2 interface = only WAN port. When you connect to switch on router or via wireless you use br0 interface. I have changed ttl only for vlan2 and I'm forced it manually - switch -o <interface name> and -i <interface name>.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 10403
Location: Netherlands

PostPosted: Sat May 28, 2022 19:23    Post subject: Reply with quote
Itsyaboy wrote:
egc wrote:
You need this rule:
Code:
iptables -t mangle -I POSTROUTING -o $(get_wanface) -j TTL --ttl-set 128

instead of 128 you can also try 65 or use:
-j TTL --ttl-inc 1

Note that -I is a capital i

Set this rule from the CLI (telnet/Putty) and check with:
iptables -vnL -t mangle

It is possible that the module with TTL is not compiled in as your router has only 16 MB flash


Thanks, Yea I’ve tried that but it doesn’t seem to change anything, is there any way to find out if it’s a problem with the module u mentioned? So I ended up updating ddwrt and iptables is now V1.8.5 and I’m getting unknown option for —ttl-set & —ttl-inc, when i look at —help for the v1.3.7 and V1.8.5 I don’t see anything for —ttl-set but it didn’t get that error on the earlier version.


It looks like the TTL target is not present in your build.

_________________
Routers:Netgear R7800, R7000, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Itsyaboy
DD-WRT User


Joined: 18 May 2016
Posts: 61

PostPosted: Sat May 28, 2022 19:39    Post subject: Reply with quote
egc wrote:
Itsyaboy wrote:
egc wrote:
You need this rule:
Code:
iptables -t mangle -I POSTROUTING -o $(get_wanface) -j TTL --ttl-set 128

instead of 128 you can also try 65 or use:
-j TTL --ttl-inc 1

Note that -I is a capital i

Set this rule from the CLI (telnet/Putty) and check with:
iptables -vnL -t mangle

It is possible that the module with TTL is not compiled in as your router has only 16 MB flash


Thanks, Yea I’ve tried that but it doesn’t seem to change anything, is there any way to find out if it’s a problem with the module u mentioned? So I ended up updating ddwrt and iptables is now V1.8.5 and I’m getting unknown option for —ttl-set & —ttl-inc, when i look at —help for the v1.3.7 and V1.8.5 I don’t see anything for —ttl-set but it didn’t get that error on the earlier version.


It looks like the TTL target is not present in your build.


What’s the best way to make sure everything is erased off the router? Like all settings and commands etc, I’m having some weird issues with ssh not working on certain apps or terminals now I’m unable to ssh at all.
the-joker
DD-WRT Developer/Maintainer


Joined: 31 Jul 2021
Posts: 1901
Location: All over YOUR webs

PostPosted: Sat May 28, 2022 20:34    Post subject: Reply with quote
Admin tab -> Factory defaults tab enable Yes, click apply settings

I would recommend you upgrade to latest build and reconfigure from scratch, do not restore any backups.

_________________
Saving your retinas from the burn!🔥
DD-WRT Inspired themes for routers
DD-WRT Inspired themes for the phpBB Forum
DD-WRT Inspired themes for the SVN Trac & FTP site
Join in for a chat @ #style_it_themes_public:matrix.org or #style_it_themes:discord

DD-WRT UI Themes Bug Reporting and Discussion thread

Router: ANus RT-AC68U E1 (recognized as C1)
Itsyaboy
DD-WRT User


Joined: 18 May 2016
Posts: 61

PostPosted: Sat May 28, 2022 22:00    Post subject: Reply with quote
the-joker wrote:
Admin tab -> Factory defaults tab enable Yes, click apply settings

I would recommend you upgrade to latest build and reconfigure from scratch, do not restore any backups.


Ok thanks, I found it weird that when I used tfpd32 to get back to stock to then go back to ddwrt, all my ddwrt setup was still there.. shouldn’t that have erased it all?


Last edited by Itsyaboy on Sat May 28, 2022 22:07; edited 2 times in total
Itsyaboy
DD-WRT User


Joined: 18 May 2016
Posts: 61

PostPosted: Sat May 28, 2022 22:05    Post subject: Reply with quote
thommy181 wrote:
I'm use that two instructions
iptables -t mangle -I POSTROUTING 1 -o vlan2 -j TTL --ttl-set 65
iptables -t mangle -I PREROUTING 1 -i vlan2 -j TTL --ttl-set 65
Sometimes you shouldn't see changes when you test this configuration on windows systems. That working for only vlan2 interface = only WAN port. When you connect to switch on router or via wireless you use br0 interface. I have changed ttl only for vlan2 and I'm forced it manually - switch -o <interface name> and -i <interface name>.


How do I find my interface on windows? I think I’m going to give this a shot there to see if it even works before I go further trying to figure this out on my router, also, would I apply this to the interface receiving the internet connection or outputting? Want to try this with windows 10 hotspot.
the-joker
DD-WRT Developer/Maintainer


Joined: 31 Jul 2021
Posts: 1901
Location: All over YOUR webs

PostPosted: Sun May 29, 2022 9:30    Post subject: Reply with quote
You should enable SSH, and connect to the router IP using putty if you're on Windows

https://the.earth.li/~sgtatham/putty/latest/w64/putty.exe for 64-bit binary
https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe for 32-bit binary

If Linux use SSH via terminal e.g.
Code:
ssh root@192.168.1.1 -p 22

If the router IP is different enter that instead. Only via SSH I recommend running those iptable commands.

To enable SSH see the Services tab and look for the Secure Shell section.

_________________
Saving your retinas from the burn!🔥
DD-WRT Inspired themes for routers
DD-WRT Inspired themes for the phpBB Forum
DD-WRT Inspired themes for the SVN Trac & FTP site
Join in for a chat @ #style_it_themes_public:matrix.org or #style_it_themes:discord

DD-WRT UI Themes Bug Reporting and Discussion thread

Router: ANus RT-AC68U E1 (recognized as C1)
Itsyaboy
DD-WRT User


Joined: 18 May 2016
Posts: 61

PostPosted: Sun May 29, 2022 23:12    Post subject: Reply with quote
the-joker wrote:
You should enable SSH, and connect to the router IP using putty if you're on Windows

https://the.earth.li/~sgtatham/putty/latest/w64/putty.exe for 64-bit binary
https://the.earth.li/~sgtatham/putty/latest/w32/putty.exe for 32-bit binary

If Linux use SSH via terminal e.g.
Code:
ssh root@192.168.1.1 -p 22

If the router IP is different enter that instead. Only via SSH I recommend running those iptable commands.

To enable SSH see the Services tab and look for the Secure Shell section.


Ok thanx, yea I don’t know why but I kept getting connection refused even tho I had ssh on, I ended up switching to openwrt and finally got this to work! Wish I could figure out why iptables wasn’t working properly on ddwrt tho :/

If anyone wants to give this a try I used “ iptables -t mangle -A POSTROUTING -j TTL --ttl-set 65” in custom firewall settings and I had to upgrade iptables-mod-ipopt with opkg upgrade
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Index -> Atheros WiSOC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum