Earlier I wanted to see if any PPTP clients were connected to an internal network through a pfSense firewall but wasn’t sure best way to do it. Turns out that outside of the pfSense command line I am not sure there is a best way so below I describe how to check for PPTP connected clients via the pfSense CLI as we as numerous way to check for connected clients via the pfSense web interface.
We recently put a Xbox 360 online at the computer shop and I finally got around to configuring everything so we could get on Xbox Live. Our network uses a pfSense firewall along with some other security measures which create a fairly secure environment however it can take some configuration to get things working properly at times. The pfSense firewall is a really amazing open source firewall software developed by some folks here in Louisville. Anyhow depending on how your firewall is set up you may run into a couple issues, which aren’t really issues, connecting to Xbox Live. Below is information on how to get past your Xbox 360 reporting that the NAT type is Strict when your Xbox 360 is located behind a pfSense firewall.
The next tool up for review in the information gathering section is tcptraceroute. tcptraceroute is a traceroute implementation using TCP packets. The more traditional traceroute sends out either UDP or ICMP ECHO packets with a TTL of one, and increments the TTL until the destination has been reached. By printing the gateways that generate ICMP time exceeded messages along the way, it is able to determine the path packets are taking to reach the destination. The problem is that with the widespread use of firewalls on the modern Internet, many of the packets that traceroute sends out end up being filtered, making it impossible to completely trace the path to the destination. However, in many cases, these firewalls will permit inbound TCP packets to specific ports that hosts sitting behind the firewall are listening for connections on. By sending out TCP SYN packets instead of UDP or ICMP ECHO packets, tcptraceroute is able to bypass the most common firewall filters.
This is the first in a series of Backtrack 4 articles I will be writing regarding the tools available within Backtrack 4. I am fairly new to Backtrack so please comment, teach me, ask questions, or whatever you prefer in the comments section below. I am going to try to go down the list of every single Backtrack 4 tool and write a complete description including instructions on how to use the tools. This first article is on 0trace (0trace.sh) which allows you to perform a traceroute from within an established TCP connection such as HTTP which will be demonstrated below.
Yesterday a colleague at my company was doing some testing with a potential partner and they needed to open a TCP port on one of our development servers so an application could bind to that port. At first I wasn’t sure how I should do this since the port didn’t need to do anything but listen for incoming connections and the remote application would simply connect to that port. To get something up immediately for them I simply had our web server listen on the requested port which worked however I did not want the web server running on this port for long so I needed to come up with another solution to simply open the port, listen for connections, and possibly log those connections so we could troubleshoot if necessary. I ended up finding an application called tcpsnoop which I explain how to compile and use below.