Wol Magic Packets

Wol Magic Packets

[claudio987]

exsists a module that can recognize Magic packet used in wake on lan? I'd like to drop Magic packets


___________________________________________________________________
30 euro di sconto sull'abbonamento annuale, solo fino al 31/8! Cogli subito la grande offerta SKY
http://click.libero.it/sky

Re: Wol Magic Packets

[Rob Sterenborg]

On Wed, August 23, 2006 11:33, claudio987\@libero\.it wrote:
> exsists a module that can recognize Magic packet used in wake on lan?

No, not specifically.

> I'd like to drop Magic packets

According to http://en.wikipedia.org/wiki/Wake-on-LAN:
"The Magic Packet is a broadcast frame, transmitted over port 7 or 9. It can
be sent over a variety of connectionless protocols (UDP, IPX) but UDP is most
commonly used. The data that is contained in a Magic Packet is the defined
constant as represented in hexadecimal: FF FF FF FF FF FF followed by sixteen
repetitions of the target computer's MAC address, possibly followed by a four
or six byte password."

Port 7/udp being echo and port 9/udp being discard, I don't see why you
couldn't block these ports.


Gr,
Rob

RE: Wol Magic Packets

[Rob Sterenborg]

claudio987@libero.it <mailto:claudio987@libero.it> wrote:
>> On Wed, August 23, 2006 11:33, claudio987\@libero\.it wrote:
>>> exsists a module that can recognize Magic packet used in wake on
>>> lan? 
>> 
>> No, not specifically.
>> 
>>> I'd like to drop Magic packets
>> 
...
>> 
>> Port 7/udp being echo and port 9/udp being discard, I don't see why
>> you couldn't block these ports. 
>> 
> 7 and 9 are default ports but Magica packets can also be
> trasmitted trought other ports:
> http://www.depicus.com/wake-on-lan/woli.aspx
> as you can see, here you can specify port number.

Yes. Well, I also received an email from Sietske van Zanen who thought
more thoroughly than I did, but he hit the wrong butten and it was not
sent to the list.
This was his answer and I have to agree with him:

[quote]
I do not see what use it is, to block this on your firewall. WoL is a
broadcast, hence it will already never traverse a firewall if it's
configured correctly. On the local LAN segment they will never pass a
firewall before reaching a LAN station. That's the whole idea of
broadcasting.
 
The best thing to do is disable WoL on the workstations.
 
-Sietse
[/quote]


Gr,
Rob

RE: Wol Magic Packets

[Rob Sterenborg]

Would you please be so kind to keep this discussion on the list by replying to
it, not to me directly.
Thanks.



On Thu, August 24, 2006 14:23, claudio987\@libero\.it wrote:
>> Yes. Well, I also received an email from Sietske van Zanen who thought
>> more thoroughly than I did, but he hit the wrong butten and it was not sent
>> to the list. This was his answer and I have to agree with him:
>>
>>
>> [quote]
>> I do not see what use it is, to block this on your firewall. WoL is a
>> broadcast, hence it will already never traverse a firewall if it's configured
>> correctly. On the local LAN segment they will never pass a firewall before
>> reaching a LAN station. That's the whole idea of broadcasting.
>>
>> The best thing to do is disable WoL on the workstations.
>>
>>
>> -Sietse
>> [/quote]
>>
>> Gr,
>> Rob
>>
> how can I block wol packets? I must disable broadcasting? In what way? I wont
> to use wol only in my lan. I have a linux box router: 192.168.0.1 and 4 pc on
> lan 192.168.0.2 192.168.0.3 192.168.0.4 192.168.0.5. I must disable it with
> iptables on 192.168.0.1 (router). Thanks

Did you read Sietse's comment?
- WOL is a broadcast and broadcasts typically *do not pass* a router, in this
case your Linux firewall.
- If the WOL packet is coming from your LAN you *cannot* block it using your
Linux firewall, because the packets *do not pass through* it.

Disable the WOL feature on your clients, as Sietse suggested.


Gr,
Rob

RE: Wol Magic Packets

[claudio987]

---------- Initial Header -----------

From      : "Rob Sterenborg" rob@sterenborg.info
To          : "claudio987@libero.it" claudio987@libero.it
Cc          :
Date      : Thu, 24 Aug 2006 17:15:28 +0200 (CEST)
Subject : RE: Wol Magic Packets







> On Thu, August 24, 2006 16:51, claudio987\@libero\.it wrote:
>
> >> Would you please be so kind to keep this discussion on the list by replying
> >> to it, not to me directly. Thanks.
>
> Would you please be so kind to keep this discussion on the list by replying
> to THE LIST, not to me directly. Thanks.
>
>
>
ok, I'm sorry, I haven't red your message at all. now can you answer me...


___________________________________________________________________
Mutui a tassi scontati da 30 banche. Richiedi online e risparmia. Servizio gratuito. 
http://click.libero.it/mutuionline

RE: Wol Magic Packets

[claudio987]

---------- Initial Header -----------

From      : "Rob Sterenborg" rob@sterenborg.info
To          : "claudio987@libero.it" claudio987@libero.it
Cc          :
Date      : Thu, 24 Aug 2006 17:15:28 +0200 (CEST)
Subject : RE: Wol Magic Packets


Rob Sterenborg... Can you answer me please?




> On Thu, August 24, 2006 16:51, claudio987\@libero\.it wrote:
>
> >> Would you please be so kind to keep this discussion on the list by replying
> >> to it, not to me directly. Thanks.
>
> Would you please be so kind to keep this discussion on the list by replying
> to THE LIST, not to me directly. Thanks.
>
>
> 


___________________________________________________________________
Prestiti da 15 istituti. Tan dal 5,90% per richieste entro il 31 Agosto. Servizio gratuito.
http://click.libero.it/mutuionline1

RE: Wol Magic Packets

[Rob Sterenborg]

"claudio987@libero.it" wrote:
> Rob Sterenborg... Can you answer me please?

Ah, right. Last time you answered "ok, I'm sorry, I haven't red your
message at all." so then I thought "what's the use to answer"..

If WOL packets really *do* enter your network then I don't know how to
block them.

According to the AMD whitepaper a WOL packet is sent using a subnet
directed broadcast to pass through routers. If you search around the
internet, you find that directed broadcasts can be blocked by using:
"echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts".
But, that's ICMP and UDP seems (commonly) to be used for WOL packets so
this would not help you.


Gr,
Rob

RE: Wol Magic Packets

[claudio987]

---------- Initial Header -----------

From      : netfilter-bounces@lists.netfilter.org
To          : "netfilter" netfilter@lists.netfilter.org
Cc          :
Date      : Mon, 28 Aug 2006 18:25:41 +0200
Subject : RE: Wol Magic Packets







> "claudio987@libero.it" wrote:
> > Rob Sterenborg... Can you answer me please?
>
> Ah, right. Last time you answered "ok, I'm sorry, I haven't red your
> message at all." so then I thought "what's the use to answer"..
>
> If WOL packets really *do* enter your network then I don't know how to
> block them.
>
> According to the AMD whitepaper a WOL packet is sent using a subnet
> directed broadcast to pass through routers. If you search around the
> internet, you find that directed broadcasts can be blocked by using:
> "echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts".
> But, that's ICMP and UDP seems (commonly) to be used for WOL packets so
> this would not help you.
>
>
> Gr,
> Rob
>
>
>
packet enters only if I send it to a port opened into the router...: for example: if I forward port 30 tcp\udp to 192.168.0.2 (pc of my lan) and I send a wol packet for another internet address out of my lan to poty 30 of external ppp0 interface of my router, pc 192.168.0.2 turns on


___________________________________________________________________
Prestiti da 15 istituti. Tan dal 5,90% per richieste entro il 31 Agosto. Servizio gratuito.
http://click.libero.it/mutuionline1

RE: Wol Magic Packets

[Rob Sterenborg]

>> If WOL packets really *do* enter your network then I don't know how
>> to block them. 
>> 
>> According to the AMD whitepaper a WOL packet is sent using a subnet
>> directed broadcast to pass through routers. If you search around the
>> internet, you find that directed broadcasts can be blocked by using:
>> "echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts".
>> But, that's ICMP and UDP seems (commonly) to be used for WOL packets
>> so this would not help you. 
>> 
> packet enters only if I send it to a port opened into the
> router...: for example: if I forward port 30 tcp\udp to
> 192.168.0.2 (pc of my lan) and I send a wol packet for
> another internet address out of my lan to poty 30 of external
> ppp0 interface of my router, pc 192.168.0.2 turns on
> 

Yes, well, you've said that before and as I said: if these *do* enter
your network then I don't know how to block them.
Perhaps you can search for the String match (it's in an older POM-ng and
which I never used) and try to catch those WOL packets by matching it's
contents. Since each WOL packet looks the same (6 bytes FF followed by
16 bytes containing the MAC address of the PC to wake up), you should be
able to do it.


Gr,
Rob

RE: Wol Magic Packets

[claudio987]

---------- Initial Header -----------

From      : netfilter-bounces@lists.netfilter.org
To          : "netfilter" netfilter@lists.netfilter.org
Cc          :
Date      : Tue, 29 Aug 2006 07:54:10 +0200
Subject : RE: Wol Magic Packets







> >> If WOL packets really *do* enter your network then I don't know how
> >> to block them.
> >>
> >> According to the AMD whitepaper a WOL packet is sent using a subnet
> >> directed broadcast to pass through routers. If you search around the
> >> internet, you find that directed broadcasts can be blocked by using:
> >> "echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts".
> >> But, that's ICMP and UDP seems (commonly) to be used for WOL packets
> >> so this would not help you.
> >>
> > packet enters only if I send it to a port opened into the
> > router...: for example: if I forward port 30 tcp\udp to
> > 192.168.0.2 (pc of my lan) and I send a wol packet for
> > another internet address out of my lan to poty 30 of external
> > ppp0 interface of my router, pc 192.168.0.2 turns on
> >
>
> Yes, well, you've said that before and as I said: if these *do* enter
> your network then I don't know how to block them.
> Perhaps you can search for the String match (it's in an older POM-ng and
> which I never used) and try to catch those WOL packets by matching it's
> contents. Since each WOL packet looks the same (6 bytes FF followed by
> 16 bytes containing the MAC address of the PC to wake up), you should be
> able to do it.
>
>
> Gr,
> Rob
>
>
>
how can I do it?


___________________________________________________________________
Salva ora il tuo preventivo gratuito Direct Line e assicurati lo sconto extra 5+5% sulla polizza auto!
http://click.libero.it/directline2

RE: Wol Magic Packets

[Rob Sterenborg]

On Tue, August 29, 2006 13:38, claudio987\@libero\.it wrote:
>>> packet enters only if I send it to a port opened into the router...: for
>>> example: if I forward port 30 tcp\udp to
>>> 192.168.0.2 (pc of my lan) and I send a wol packet for
>>> another internet address out of my lan to poty 30 of external ppp0
>>> interface of my router, pc 192.168.0.2 turns on
>>>
>>
>> Yes, well, you've said that before and as I said: if these *do* enter
>> your network then I don't know how to block them. Perhaps you can search for
>> the String match (it's in an older POM-ng and which I never used) and try to
>> catch those WOL packets by matching it's contents. Since each WOL packet
>> looks the same (6 bytes FF followed by 16 bytes containing the MAC address
>> of the PC to wake up), you should be able to do it.
>>
>> Gr,
>> Rob
>>
> how can I do it?

By downloading a kernel, POM-ng (patch-o-matic-ng) and an older POM-ng that
still has the string patchlet, and iptables. Patch the kernel using the older
POM-ng for the string match and use the newer POM-ng for recent stuff. Install
the new kernel and iptables and see if everything (still) works.

If you've never done this I suggest you search the internet for howto's, read
the README's and/or INSTALL files and try it with a test-PC first.
Howto's on patching a kernel is not really the scope of this list.