I want to configure the TTL to 1, this in order to prevent those who I allow to connect to my network from sharing the internet with their cell phone or other device, either as an access point or as a bluetooth.
Please I need help regarding this issue. I'm not quite sure what packages to install and what configuration to do and how to do it.
I use the script below, stored at /usr/share/nftables.d/ruleset-post/adjust-ttl.nft, to change ttl in a different context:
# adjust-ttl
# This nft script facilitates adjusting the ttl of outgoing packets
# author: Lynx (OpenWrt forum)
table inet adjust-ttl
flush table inet adjust-ttl
table inet adjust-ttl {
chain hook-postrouting {
type filter hook postrouting priority filter
# fix ttl to help disguise use of router over mobile network
# for bridge mode set ttl to 64
# for USB tethering set ttl to 65
oifname wan ip ttl set 65
}
}
1 Like
Setting a TTL to 1 would cause all traffic destined for the Internet to fail at the first router it encounters (i.e. TTL Exceeded in Transit).
You would need to make a custom rule that only allows your devices a TTL of X (and higher).
where x == the normal TTL of the client as received on the ingress interface on the OpenWrt.
1 Like
Well, what I really want is that they cannot share the internet connection as an access point or via bluetooh from other cell phones. I mention the TTL thing because that's what I saw was an option, but I didn't know the problems that this can cause. The router that I have with the OpenWRT firmware is the main one and from there the devices that I want to limit are connected (in fact I would even like to limit only a few, and with my cell phone I have free access).
But I think the idea still holds.
There may be a simpler option here, and hopefully someone will suggest something.
@dave14305 any thoughts?
2 Likes
Change the interface name from wan to br-guest or whatever LAN-like interface is serving the devices connected.
So inbound traffic from WAN to LAN should be set with TTL of 1 or IPv6 hoplimit of 1?
nft add rule inet fw4 mangle_postrouting oifname "br-lan" ip ttl set 1
nft add rule inet fw4 mangle_postrouting oifname "br-lan" ip6 hoplimit set 1
2 Likes
Well if you can play TTL/hoplimit games so can your users...
3 Likes
Ah yes - nice!
True, but that's some next level shizzle.
2 Likes