How to penetrate NAT - Page 1
Forum section: electronics / general

author: peter-h
author_rank: Super Contributor
timestamp: April 14, 2025, 08:39:21 am
content: This came up in a discussion (on a different topic) a while ago.It generated various pompous responses (the usual kind seen in "security" threads) but no detail.So I asked claude.aihttps://claude.ai/chat/75b2aaa3-471e-4f1d-aa6e-6a8897342a3eAttacking a device behind a NAT (Network Address Translation) router presents several challenges since the device isn't directly accessible from the internet. Here are common techniques used to bypass NAT protection:Port Forwarding ExploitationIf the router has port forwarding configured, an attacker can directly access the internal device through those open portsMisconfigured port forwarding rules might expose unintended servicesUPnP ExploitationMany routers have Universal Plug and Play (UPnP) enabled by defaultMalicious code running on an internal device can use UPnP to automatically configure port forwardingSome UPnP implementations have vulnerabilities allowing external manipulationNAT SlipstreamingTricks the victim into visiting a malicious websiteUses JavaScript to generate specific traffic patterns that cause the NAT router to open ports to the internal deviceWorks by exploiting how routers track connection statesNAT Traversal TechniquesConnection tunneling through allowed protocols (SSH, HTTPS)UDP hole punchingTCP hole punchingSTUN/TURN server utilizationSocial EngineeringConvincing users to install remote access toolsPhishing campaigns delivering malware with outbound connectionsTricking users into configuring port forwarding themselvesCompromising the RouterExploiting router vulnerabilities to gain admin accessChanging router settings to allow inbound connectionsDNS hijacking to redirect trafficDNS Rebinding AttacksTricks browsers into executing JavaScript that accesses internal network resourcesWorks by changing DNS responses during a browsing sessionInternal Network Scanning from Compromised DeviceIf one device on the network is compromised, it can be used as a footholdThe compromised device can scan and attack other internal devicesDefensive measures include keeping routers updated, disabling UPnP, using strong router credentials, employing network segmentation, and monitoring outbound connections.RetryClaude can make mistakes. Please double-check responses. 3.7 SonnetOf the above, all are obvious and all but one are irrelevant.The NAT Slipstreaming method ought to work to some extent. You need to know which IP the target is accessing so you can send in packets "from" that IP which should be passed back to the client device behind the router. I would expect a NAT router to dump packets from a different IP, otherwise a NAT router would be wide open to all traffic, for 180 seconds from the last outgoing traffic, which on many systems would be basically permanentlyBut sending the attack from a fake IP also means that you cannot get a reply, so the packet you send has to be suitably malformed to make use of some exploit / back door in the target device. Is this correct?If it is possible to send in a packet from the fake IP but with a broadcast destination, it would be routed to the entire LAN behind the NAT router. But surely a NAT router would dump such packets?

author: Jeroen3
author_rank: Super Contributor
timestamp: April 14, 2025, 10:01:59 am
content: Yeah, ai doesn't know things. It rambles. It's more complicated.What it describes isHole Punching. An already commonly used method to open up a nat+firewall. It does know about this. But doesn't connect them.Broadcast does notroute, and will be dropped the first hop.Your router should drop any malformed packets.Packets that arrive with dst ip 255.255.255.255 on WAN are not routed, they are only switched/bridged.Only packets arriving with the correct dst ip of the WAN interface should be accepted into thegateway.Then it looks into it's tracked connections to see if knows where to send the packet. If there isn't any, it's dropped.You can't trick your way around NAT, it only opens from the inside. Or there is an exploit in the router. Like UPnP.Slipstreaming requires that you can generate packets inside the target network. Random javascript shouldn't be able to generate the required packets for net hole punching to arbitrary IP's. But we all know browsers are leaky. So you will already need something running, or exploit something on the target network, and probably with elevated access to generate "malformed" packets. (packets with a different src ip)But there is a ubiquity of unpatched linux kernels in smart home gear that people did port forward to....https://www.shodan.io/

author: madires
author_rank: Super Contributor
timestamp: April 14, 2025, 10:14:50 am
content: Before answering your questions, I'd like to emphasize that there are many types of NAT. It's a general term like 'computer'.Quote from: peter-h on April 14, 2025, 08:39:21 amYou would need an ISP who doesn't have anti-spoofing filters in place (unfortunately still many) and you would be limited to UDP (or other protocols without any handshaking), in theory.Quote from: peter-h on April 14, 2025, 08:39:21 amBroadcast implies IPv4. There would be no routes for the victim's LAN with RFC1918 private address space. If, for whatever reason, you would be able to route to the victim, his router should ignore the packet with the broadcast destination address. Usually responses to broadcast addresses are disabled in routers for various reasons (one is to prevent that simple amplification attack).

author: peter-h
author_rank: Super Contributor
timestamp: April 14, 2025, 10:30:29 am
content: QuoteOK - that is like GotoMyPC, IIRC. But that needs your code running on the inside.QuoteThe method I thought would work requires knowledge (or correct assumption) that the target machine is accessing some external IP, and you keep sending UDP packets to the target router, say every 10s, with a fake From address identical to the presumed external one, until the target goes online and then your fake packet should be routed to the target.It would need to be a malformed packet which causes something to happen, by crashing (etc) the target machine. Windows had loads of vulnerabilities like that, for example. Embedded systems, probably not so much.

author: madires
author_rank: Super Contributor
timestamp: April 14, 2025, 10:43:17 am
content: Quote from: Jeroen3 on April 14, 2025, 10:01:59 amPicking a special case might be not the best idea. Let's go for something more common. 1.2.3.255 is the broadcast address of 1.2.3.0/24, is a vaild destination address, and is routed. If one ethernet interface of my Cisco router would have 1.2.3.1/24 I'd set "no ip directed-broadcast" to prevent trouble.

author: Jeroen3
author_rank: Super Contributor
timestamp: April 14, 2025, 10:44:56 am
content: Yes, theoretically such a UDP packet would go into the router.But there are several challenges:- getting the packet there- you are giving your ISP a packet with a different src ip than your interface,- and then the backbone gets an src ip outside it's block. It is trivial to detect that it shouldn't be there.I think this goes into BGP, but I'm not familiar with that part of networking.- knowing which from packet to craft.- Which would basically mean you already being the mitm.- Getting data back- Remember the malformed src ip?So you'd also need to find a service vulnerable to a injected packets.

author: 2N3055
author_rank: Super Contributor
timestamp: April 14, 2025, 10:53:16 am
content: If I may ask to OP, why do you spam us with AI (it should be actually called RS , as in Real Stupidity) ramblings?If you need answer, simply ask the question.NAT is network address translation. There is also PAT, port address translation.It is basically assigning alias address to real one so devices coming from some zone see different IP/port than orginal.That in itself is not a security measure.Then there is something called NAT masquerading. It uses NAT/PAT to hide devices on one security zone from other security zone (usually WAN to Internet) by translating all internal traffic to appear to come from single IP and does not allow any incoming traffic, unless it is a response to some request from inside.NAT Masquerading cannot be "penetrated" if done right.All you can do is create workarounds, that basically work by compromising a device on the inside to do hacker bidding. Basically you need something to contact you from "inside" and to give you control over something.So instead of you asking something directly to a device, device have to contact you and say "now ask me a question or tell me what to do."That is how Team Viewer works too....Quote from: peter-h on April 14, 2025, 10:30:29 amNo, that does not work. You simply cannot enter inside unless invited in. Like vampires.So hacker work on you inviting them in. By you installing some software, by sending emails with exploits, by using web sites with exploits.That way they install backdoor and that code gains them entrance..

author: peter-h
author_rank: Super Contributor
timestamp: April 14, 2025, 11:09:20 am
content: QuoteUltimately that seems necessary for any NAT penetration to work - because that UDP packet cannot ever get a reply which you can pick up.One would need to hope that the inside device, having received the malformed packet, will do something the attacker wants e.g. open a port in a UPNP consumer router, run a fake DNS server on the LAN, etc.

author: madires
author_rank: Super Contributor
timestamp: April 14, 2025, 11:18:50 am
content: Quote from: Jeroen3 on April 14, 2025, 10:44:56 amThe anti-spoof filtering is done on the access router, incl. filters for RFC1918 address space. BGP doesn't care about source addresses and many ASs deploy prefix filters for RFC1918 addresses, i.e. they won't accept any such routes. However, since RFC1918 addresses are often used internally for things like a management network and nobody is perfect you'll see RFC1918 route leaks from some ASs. And because of your RFC1918 prefix filter you prevent them from leaking into your network.

author: Siwastaja
author_rank: Super Contributor
timestamp: April 14, 2025, 11:35:10 am
content: In short:Buggy/crappy/misconfigured router, orBuggy/crappy/misconfigured device on the local network which can be used as a relay. One random IoT gadget is enough.A relay device can just connect to the Internet e.g. with a TCP socket acting as a client, no one thinks anything weird is going on. Then it can just freely send and receive packets on your "safe" local network. Job done.As such, any IoT device reallyshouldbe designed to the same level of security, regardless of if it will be connected behind a NAT, or directly with a public IP address. Notice the word should. I don't want to be too judgemental. Of course a NATting router reducesaveragerisk. You make the decisions of what you are shipping. Status quo is pretty crappy, so you can be far from ideal accepted safe solution yet still much better than industry average!We (with an Ethernet device) also have bunch of customers (1% or so) who connect with public IP address simply because they don't have a router at home at all. Just a switch behind a fiber modem. We instruct to always use a router, but people do not read all instructions, that is normal.

author: madires
author_rank: Super Contributor
timestamp: April 14, 2025, 11:43:57 am
content: Quote from: peter-h on April 14, 2025, 11:09:20 amI think you're missing one imported point. The router keeps track of the connections. If you manage to make the victim's PC open a UDP connection to some destination address, the router notes the addresses and ports. The UDP response (or spoofed packet) needs to return to the same port on the router side. Then the router will pass on the response to the PC while changing the destination address and port (the same port used for starting the initial outbound connection). If the PC's TCP/IP stack has a vulnerabilty it might be triggered by the spoofed UDP response. But if you need to attack a specifc service it will be harder, because the port number has to match and OSs usually guard so called system ports (< 1024). This would require the inital outbound connection to be started as admin/root.

author: nctnico
author_rank: Super Contributor
timestamp: April 14, 2025, 01:06:01 pm
content: Quote from: Siwastaja on April 14, 2025, 11:35:10 amThat sounds odd. How do they share internet between several devices? And how about DHCP? The ISP would need to provide all the services a router provides and a bunch of public IP addresses (one for each device).

author: peter-h
author_rank: Super Contributor
timestamp: April 14, 2025, 01:12:48 pm
content: QuoteGood luck running linux / centos / apache / nginx / etc on a 32F417Same level of security is simply not possible. The above code has been tested under extreme attack conditions for many years. You will never achieve that with an embedded box.OTOH the embedded box will likely have other strengths e.g. no file system (that permits executables to run), hard-coded certificates, etc. And a certain level of opacity, while frowned upon by purists, is a lot better than open sourceEven if the product can be openly purchased and disassembled; only a serious attacker will be interested then, and a serious attacker will find other ways, e.g. bugging the internal LAN directly.ISTM that if you are behind NAT, no casual attacker will ever even find your box.I am picking up this debate since in the heating controller thread a bunch of people were basically saying that NAT is worthless, which is clearly not true.https://www.eevblog.com/forum/microcontrollers/how-would-you-do-a-heating-controller-iot-client-securely/QuoteI suppose in the case of a single remote device e.g. a security camera, you could just do this. Set up a fixed IP on it, and it "should just work"

author: nctnico
author_rank: Super Contributor
timestamp: April 14, 2025, 05:06:16 pm
content: Quote from: peter-h on April 14, 2025, 01:12:48 pmFor a casual hacker that is correct. But if an attack is specifically targeted, getting through a NAT router is theoretically possible. It will take quite a bit of resources though. So for a high value target, NAT by itself it not enough. There will need to be additional protection to ensure both devices communicating can authenticate that they are talking to an authorised party.

author: Siwastaja
author_rank: Super Contributor
timestamp: April 14, 2025, 06:55:44 pm
content: Quote from: nctnico on April 14, 2025, 01:06:01 pmThe fiber modem provides DHCP. That's how it gives the public IP address to the recommended router as well. If a switch is used instead of a router, multiple devices each get their own public IPv4 address, and can communicate with each other - and the rest of the world. What a security disaster. I know it sounds weird, Finland saw this cult-like trend of small fiber ISPs popping up like mushrooms after rain, offering fiber connections especially to countryside where it makes least sense economically (because wireless is never congested), but somehow it works out. I have this, too, and it cost like 500EUR including excavator work. But at least I do have a router.We also see carrier-grade NAT addresses on some of our customers.

author: grumpydoc
author_rank: Super Contributor
timestamp: April 14, 2025, 07:43:41 pm
content: Quote from: peter-h on April 14, 2025, 01:12:48 pmQuite - though there's a YT video with some guy running Linux on a 429 - not quite sure how *much* of Linux and he needed an 8M external RAM.Something like UClinux might work and it does target M4 but I don't think you will be running a firewall on it.Absolute minimum for OpenWRT is 8MB flash and 64MB RAM but that is depreciated and will only work with older releases - 16MB/128MB should be OK.

author: nctnico
author_rank: Super Contributor
timestamp: April 14, 2025, 07:56:33 pm
content: Quote from: Siwastaja on April 14, 2025, 06:55:44 pmWowJust wow. Brings back memories though from the 1990's when I was doing network stuff. A local ISP hired me every now and then to setup / fix things at their customers (Linux firewalls and so on). One of these companies was a big international company. All the PCs in their offices had public IP addresses so co-workers could share files between eachother using FTP across the globe. Hard to imagine nowadays.For rural areas it makes sense to use wireless indeed. 4G / 5G internet is pretty fast. In lesser developed countries having a fixed internet connection is more expensive compared to using a mobile data modem in your computer (or use your phone as a Wifi hotspot which also functions as extra protection).

author: Jeroen3
author_rank: Super Contributor
timestamp: April 15, 2025, 06:26:23 am
content: Quote from: nctnico on April 14, 2025, 01:06:01 pmEach computer creates their own PPPoE connection. Please note how PPPoE works on layer 2, there are no IP addresses yet.This would be comparable to dial-up.

author: peter-h
author_rank: Super Contributor
timestamp: April 15, 2025, 08:39:20 am
content: QuoteThe problem is that this gives you security only if the box has no back doors.Otherwise one could just say anything running 2k bit RSA / AES256 is totally secure. And yes it is totally secure from the POV of snooping on the "wire" (quantum attacks on PKC excepting, blah blah) but almost nobody is breaking crypto. Attacks, especially State level ones, probably all use back doors.By "resources" do you mean setting up a server which continually hits the target router and waits for the outgoing channel to be opened?

author: nctnico
author_rank: Super Contributor
timestamp: April 15, 2025, 09:20:27 am
content: Quote from: peter-h on April 15, 2025, 08:39:20 amNot just a server but having access to the actual traffic that flows to & from the target. IOW: digging up a cable and splitting it so traffic can be monitored and injected. And it still requires doing some kind of survey to get an idea on how the network is setup at the target. This requires investigation and social engineering to gather information. All in all not cheap. Putting a server somewhere that randomly sends (spoofed) IP packets is going to take way too long.

author: peter-h
author_rank: Super Contributor
timestamp: April 15, 2025, 09:38:34 am
content: You can probably find out the IP of some installation, because e.g. SMTP emails contain the sender's IP. Then you can hit it with the fake packets.I am still trying to understand all the lecturing about NAT being insecure. It seems practically impenetrable to me, unless the target router is wide open. Then the "expert" will say you need a proper firewall, but a firewall is just another chinese linux box, just like the NAT routerThen somebody will say you need a "hardware firewall" but that is just a chinese linux box with a big FPGA, running some HDL implementation of a packet filter.

author: madires
author_rank: Super Contributor
timestamp: April 15, 2025, 10:36:55 am
content: A typical SOHO router (stateful firewall plus masquerading) with UPnP disabled provides sufficient protection for a home user or small business. The potential issues discussed are something for an advanced or professional attacker targeting a specific person or organisation, not something bots are doing all day long. I think you're getting lost in the complex details, which are hard to grasp for non-network profrssionals.

author: peter-h
author_rank: Super Contributor
timestamp: April 15, 2025, 01:23:45 pm
content: Well, you network professionals confirmed what I thought

author: Jeroen3
author_rank: Super Contributor
timestamp: April 15, 2025, 01:27:35 pm
content: Quote from: peter-h on April 15, 2025, 09:38:34 amMuch easier, just send a tracked link or image in an email or chat that points to a service you manage the tracking data of.If you know of any zero days, in say the image processor of a browser, saycve-2023-41064then you're in!

author: peter-h
author_rank: Super Contributor
timestamp: April 15, 2025, 01:38:43 pm
content: Right, of course, but that assumes there is some human presence there (which admittedly my SMTP IP example also assumed).If you have just some IOT box behind a NAT router, doing some sort of remote control, you will need to find out the IP (or guess it) some other way.But anyway let's assume you know the external IP of the NAT router...