Hiding NATs with PF

From: Max Bolingbroke (batterseapower{no_at_spam}hotmail.com)
Date: 09/28/05 

Date: Wed, 28 Sep 2005 03:01:55 +0100

Hi,

It's my first time out with OpenBSD and I'm building a little NAT
device. Its been great so far, it's really well put together. I
especially like PF, but I'm having trouble making my NAT "invisible".
What I mean by this is that I want to make it look identical to a single
host on the internet (assume application level proxying is not practical
in this scenario). I've already enabled the usual suspects in scrub:
no-df, min-ttl, random-id, fragment reassemble and reassemble tcp. I
also added state modulation to outgoing traffic for good measure.

This has covered the two main bases: TTL monitoring and statistical
analysis of IP IDs. However, I'm still going to be vunerable to passive
OS fingerprinting. Are there any further ways I can have PF munge my
outgoing packets so look like they all come from the same flavour of TCP
stack?

Thanks in advance!

Max Bolingbroke

Relevant Pages

  • Re: pf experts pls help: clients cant do NAT, gateway connects okay
    ... I'd like to ask you what your DSL modem offers: does it do NAT ... OpenBSD box do transparant-filtering in bridging mode, ...
    (comp.unix.bsd.openbsd.misc)
  • Re: NAT Help Please
    ... > I use OBSD as my router/gateway for my home network. ... box instead of on the OpenBSD box (or the OpenBSD box without any IP ... NAT; but all three ways will work ... do transparent bridging firewall and use public ips behind the firewall on ...
    (comp.unix.bsd.openbsd.misc)
  • Re: Unexpected termination of http connections through nat.
    ... packetfilter with a NAT rule? ... or something general to NAT) ... behind a old OpenBSD installation (3.0 - please: no discussion: i know ...
    (comp.unix.bsd.openbsd.misc)
  • pf & NAT
    ... OpenBSD, I use Linux more): the NAT isn't working. ... bastien@arrakeen:~$ sudo tcpdump -vv -i eth1 icmp ...
    (comp.unix.bsd.openbsd.misc)