Varying source address and stateful firewalls (Was: Multiple Endpoints)

[Baptiste Jonglez]

On Mon, Jan 09, 2017 at 12:00:17AM +0100, Jason A. Donenfeld wrote:
> > I merely pointed out that a stateful firewall is similar to a symmetric
> > NAT, that is, both would cause issue with peer roaming.
> 
> Are you sure about this for UDP? I did a bunch of tests several months
> ago, and was able to punch holes in a variety of stateful firewalls
> with changing remote IPs.

I must admit I had never tested :)

I just did, though, and yes, the stateful firewall from Linux does block
UDP traffic from unrelated source IP addresses.  So I guess your hole
punching was based on some other property.

Here is the setup with 3 computers A, B, C.  There is a stateful firewall
on A, and A opens a UDP connection towards B.  C then tries to pretend to
be B and contacts A with the same src/dest port.

    A# iptables -F INPUT
    A# iptables -A INPUT -p udp -m conntrack --ctstate ESTABLISHED -j LOG --log-prefix="established: "
    A# iptables -A INPUT -p udp -m conntrack --ctstate RELATED -j LOG --log-prefix="related: "
    A# iptables -A INPUT -p udp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    A# iptables -A INPUT -p udp -j LOG --log-prefix="drop: "
    A# iptables -A INPUT -p udp -j DROP

A and B communicate normally:

    B# nc -l -u -p 5001
    A# nc -u -p 60000 $IP_B 5001
    A# #type something
    B# #type something else

At this point, there is an entry in the conntrack table of A:

    A# conntrack -L | grep $IP_B
    udp      17 22 src=$IP_A dst=$IP_B sport=60000 dport=5001 src=$IP_B dst=$IP_A sport=5001 dport=60000 mark=0 use=1

Also, the packet from B to A has been logged by our firewall rules:

    kernel: established: IN=wlan0 OUT= SRC=$IP_B DST=$IP_A LEN=33 TOS=0x00 PREC=0x00 TTL=62 ID=43432 DF PROTO=UDP SPT=5001 DPT=60000 LEN=13

Now C tries to chime in, contacting A and pretending to be B:

    C# nc -u -p 5001 $IP_A 60000

The result:

    kernel: drop: IN=wlan0 OUT= SRC=$IP_C DST=$IP_A LEN=34 TOS=0x00 PREC=0x00 TTL=64 ID=43124 DF PROTO=UDP SPT=5001 DPT=60000 LEN=14

So, the packet from C is dropped, even though it has the same source port
and destination port as the ones from B.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.zx2c4.com/pipermail/wireguard/attachments/20170109/03323a86/attachment.asc>