Openwrt NAT ALG
https://openwrt.org/docs/guide-user/firewall/fw3_configurations/fw3_nat
sipp ( SIP test tool )
https://github.com/SIPp/sipp
https://sipp.readthedocs.io/en/latest/
https://tomeko.net/other/SIPp-MinGW/index.php
NAT ALG (FTP SIP PPTP)
https://forum.openwrt.org/t/sip-alg-on-openwrt/88062
install kerner mod
root@OpenWrt:~# opkg install kmod-nf-nathelper-extra
enable configuration
root@OpenWrt:~# cat /etc/sysctl.d/11-nf-conntrack.conf
net.netfilter.nf_conntrack_helper=1
View dynamic connection sessions
root@OpenWrt:~# cat /proc/net/nf_conntrack
NAT Slipstream attack
https://www.armis.com/research/nat-slipstreaming-v20/
Are slipstream attacks possible through an OpenWRT router with the default configuration? It seems the NAT slipstream attack was announced the day before yesterday. In short, it is described as an attack on web browsers behind Application-level Gateway (ALG) capable routers. I do not fully understand whether that applies to OpenWRT or not. What I did learn and understand is that according to Wikipedia, ALG is in netfilter on Linux. Unfortunately I could not detuct the answer to my question fro…
With the package kmod-nf-nathelper-extra which I use for proto_gre (and also unfortunately loads sip helper modules) the router is vulnerable as tested on this site: http://samy.pl/slipstream/server So at the moment, the best course of action is to NOT use any NAT helper modules.
As described above, the new variant to the NAT Slipstreaming attack is comprised of two primitives, the first explores the H.323 ALG, and the second expands the attack surface of the various NAT ALGs reachable from a browser, by abusing the WebRTC TURN server API via Javascript. However, the actual risk imposed by this attack depends on the interaction between the second-stage traffic generated via different browser primites, and the specific implementation of targeted NAT. Not all NATs support all ALGs, or enable them by default, and actual implementations of NAT ALGs differ greatly, and can limit potential attack in different ways.
We performed several tests, to establish the effects of abusing the above techniques against the implementation of various ALGs from various router/firewall vendors. Many of the commercial or open source router/firewall offerings allow an evaluation of their product in the shape of a VM, that runs the exact same software as the real product. We conducted most of our testing on such VMs.
It should be noted that on Linux, from kernel version 4.14 upwards, “default automatic helper assignment has been turned off for security reasons” (helper meaning ALG in this context). This disables the exact behaviour that we are exploiting. This is very good, however, many consumer grade routers run older kernels, and some of the more updated Linux based products re-enable this disabled feature using the “/proc/sys/net/netfilter/nf_conntrack_helper” flag, as it is still useful for many users.
OpenWRT, a Linux based router distribution, with kernel 4.14+
Current versions are not affected. The netfilter conntrack ALG modules are not shipped.
Even if the package is installed, the “automatic assignment” is still disabled.
Siproxd configuration
https://openwrt.org/docs/guide-user/services/voip/siproxd
Siproxd is a proxy/masquerading daemon for the SIP protocol. It handles registrations of SIP clients on a private IP network and performs rewriting of the SIP message bodies to make SIP connections work via an masquerading firewall (NAT). It allows SIP software clients (like kphone, linphone) or SIP hardware clients (Voice over IP phones which are SIP-compatible) to work behind an IP masquerading firewall or NAT router.
In /etc/config/siproxd you can configure Siproxd. You can add to the default configuration to setup the plugins that you’d like to use. For example to load and configure the regex plugin something along the following lines would be appropriate:
Load regex plugin and define some replacement rules to ensure that
local and domestic numbers without area/country code are dialled
properly:
list load_plugin 'plugin_regex.so'
International calls, prefix 00 converted to +:
00 385 1 123456 -> +385 1 123456
list plugin_regex_desc = 'Intl'
list plugin_regex_pattern = '^(sips?:)00'
list plugin_regex_replace = '\1+'
Domestic calls to a different area code, drop the 0 and prefix with
country code added:
01 123456 -> +385 1 123456
list plugin_regex_desc = 'Domestic'
list plugin_regex_pattern = '^(sips?:)0'
list plugin_regex_replace = '\1+385'
Local calls without an area code - prefix with country code + local
area code:
123456 -> +385 1 123456
list plugin_regex_desc = 'Local'
list plugin_regex_pattern = '^(sips?:)'
list plugin_regex_replace = '\1+3851'
============= End
Original: https://www.cnblogs.com/lsgxeva/p/16462241.html
Author: lsgxeva
Title: Openwrt NAT ALG
原创文章受到原创版权保护。转载请注明出处：https://www.johngo689.com/546402/
转载文章受原作者版权保护。转载请注明原作者出处！