Bypass Anti Tethering

[xiv3r]

vim /etc/nftables.d/ttl64.nft

chain mangle_prerouting_ttl64 {
  type filter hook prerouting priority 300; policy accept;
  counter ip ttl set 64
  counter ip6 hoplimit set 64
}

[lleachii]

Just FYI:

• There's quite a few threads on this already
• OpenWrt switched from iptables to nftables in a former release - this won't work by default on newer firmware
• Other threads provide native nft syntax to perform the same function without installing additional software

[brada4]

Kinda converted particular ruleset yesterday.

How to setup Proxy for bypassing isp limit?

REF: Changing TTL on the new OpenWRT versions - #13 by brada4 chain raw_output { type filter hook output priority raw; policy accept; oif $wan_devices ip ttl { 2-64 , 66-255 } ip ttl set 65 # oif $wan_devices ip6 hoplimit { 2-64 , 66-254 } ip6 hoplimit set 65 } chain mangle_prerouting { type filter hook prerouting priority mangle; policy accept; iif $wan_devices ip ttl { 1-64 , 66-255 } ip ttl set 65 # iif $wan_devices ip6 hoplimit { 1-64 , 66-254…

Interestingly which provider started to battle tethering to rise interest in this....

[xiv3r]

this is only applicable on wireless hotspot with anti tethering enabled. It's like receiving 1 ttl and broadcast it into 64 ttl

AP ttl=1 radio0 -> Openwrt router radio1 ttl=64

[brada4]

There is other check for ttl=64 in upload direction sometimes.
something like ping -t 62 8.8.8.8 should be dropped then from the phone or lan.

[xiv3r]

Im connected to the AP with ttl=1 from a gateway 10.0.0.1 (Anti Tethering Enable) using this Keenetic router on WISP mode it will set ttl Outbound into 64 instead of 0

those iptables rules are for wireless isp mode only that will accept ttl=1 and broadcast ttl=64 for wireless clients

[brada4]

Test outside site not gw...