stealthing Centro Grande

Truffy

Hi all!

I used to have a Netgear ADSL modem attached to a Netgear FVS318v3 firewall, and stealthed nicely according to ShieldsUP! (http://www.grc.com/)..)

Swisscom changed my connection and the old modem no longer works. I have to use Centro Grande, and now all but two of my first 1056 ports are showing as closed, not stealthed.

I assume that this is because of the Centro Grande responding. Is there any way to make it less chatty?

Induktionator

I just got VivaCasa**** and a CentroGrande router too.

At https://www.grc.com I get:

Your system has achieved a perfect "TruStealth" rating. Not a single packet — solicited or otherwise — was received from your system as a result of our security probing tests. Your system ignored and refused to reply to repeated Pings (ICMP Echo Requests). From the standpoint of the passing probes of any hacker, this machine does not exist on the Internet. Some questionable personal security systems expose their users by attempting to "counter-probe the prober", thus revealing themselves. But your system wisely remained silent in every way. Very nice.

STEALTH

...

Here's what I did:

Go in your router's management web page 192.168.1.1, then set

- Settings > Add a new device > IPaddress 192.168.1.254, give a name like "NAT black hole"

- Setting > IP passthrough > NAT default mode, "NAT black hole"

Important, you must not have a machine on that address or it is completely vulnerable.

That's it. There was a silent SW update and I had to reactivate it once so far.

The only internal traffic should be an occassional ARP packet that never gets an answer.

v=L di/dt

Truffy

Thank you Induktionator, that's very helpful.

I now have all but one port (port number 1) stealthed. Whether I set NAT to "Nat black hole", as you suggest, or to my firewall, port 1 still responds as closed.

Firmware is up to date. But it looks as if my Centro Grande doesn't like being totally gagged.

Induktionator

I see the same.

I tried adding a custom port forwarding rule but with no change. Swisscom still needs something to do remote management, so 100% stealth is probably not possible.

Truffy

If you're seeing that port as closed, it's strange that ShielsUP! gave a your system a clean bill of health.

But this is getting wierd. My router is now creating pretty patterns!

Induktionator

This is utterly bizarre, a few days ago it was completely green, and now I have the pattern too, but it shifts each time I run the test. I think it somehow gives a delayed answer and that makes the funky pattern, but as it's on the VDSL2 side I have no convenient way to trace packets. I suspect the IP passthrough isn't working as I expect it should.

I'll play a bit and see if I get a more solid solution.

Induktionator

Found something more.

Try the ''User specified custom port probe" on grc.com, give a range like 1-32, then try again with 10-42 then again with say 15-45.

My result is always that for small ranges, all report stealth.

For larger ranges the first say, 25 ports report stealth, and then 3 report 'closed', and then the rest report stealth. The ports reported 'closed' depend the port number where you start the scan. I suspect there's a very delayed 'ICMP destination unreacheable' sent, and the delay results in this odd pattern.

Without adding more hardware for example, an additional HW firewall or an embedded system (RTEMS etc.) with a patched IP stack that responds to ARP but nothing else,

I think this is about as good as we are going to get for now.