[Patch 0/2] Avoid direct connections between NATed hosts

[Eric Leblond <eric@inl.fr>]

[-- Attachment #1: Type: text/plain, Size: 951 bytes --]

Hi,

Some algorithms can be used to established direct connections between
NATed hosts. Skype is one of the programs using this kind of "feature".

Some details can be found here :
	http://www.heise-security.co.uk/articles/print/82481

It uses the fact that port is usually sequentially increased and is thus
predictable.

This patches against kernel and iptables add the capability to randomize
the source port used when doing SNAT.

Tests have been done and have show that Skype is no more able to
established a direct connection between NATed hosts.

Randomization of the source port can be activated on a per-rule basis
with the following syntax:

iptables -A POSTROUTING -t nat -o eth0 -j SNAT --to 192.168.1.3:random

or

iptables -A POSTROUTING -t nat -o eth0 -j SNAT --to 192.168.1.3:1234-3456:random

BR,
-- 
Éric Leblond, eleblond@inl.fr
Téléphone : 01 44 89 46 39, Fax : 01 44 89 45 01
INL, http://www.inl.fr

[-- Attachment #2: Ceci est une partie de message numériquement signée --]
[-- Type: application/pgp-signature, Size: 189 bytes --]