ISP has managed to block all NAT traffic

[mndar]

They were trying to do that for quite a long time and they finally did it!!
I have a pppoe connection.
I have tried using it through my Linksys router as well, doesn't work.
The only connectivity I get from behind my router/Fedora Firewall Box is reply to any 'ping' requests. Neither DNS resolution nor an attempt to establish a TCP connection works.
However, traffic flows smoothly up to the gateway. Beyond that nothing works for devices behind the firewall/router.
Anyone experienced similar behavior with any of the other ISPs ?
How do you think they are doing this ? I'm guessing they are identifying the ports from which the connections are originating.

[fireball]

Just a thought, but have you tried changing the IP address of your router? If they're going by a list of default router IP addresses, that would be an easy fix. Also, (and forgive me if this sounds stupid, but...) have you tried switching to another nameserver. I use Comcast, and the number of sites that wouldn't resolve was getting out of hand. So I added OpenDNS'es nameservers to my network config, and the problem went away.

[mndar]

Its a pppoe connection, so the external IP of the router is dynamic. Its assigned by the ISP.

I've tried the name server thing. Doesn't work.
PCs behind the router are able to get replies to 'ping' requests. TCP connections don't get established at all. Something like "telnet 64.233.187.99 80" doesn't work. DNS Resolution (tried OpenDNS as well) doesn't work either.

[Nokia]

There's nothing spectacular in what they've done to you. My guess is they're sending you TTL=1 TCP/UDP packets. Try seeing that in Wireshark. I guess you could bypass that using a carefully crafted linux box as a router, but that's about all I can tell you about the subject.

[mndar]

I've observed the traffic in Wireshark.
TCP requests that originate from a PC on the internal network receive no reply whatsoever while they ones that originate from the Linux router get an immediate response.

[Nokia]

That would mean they look at the received TTL and notice that there has been an abnormal TTL. (Passing through eache node/router, the TTL value decreases by one, meaning that the last router, when receiving a packet with ttl=1 will eventually discard it even if the destination address is one of it's directly connected networks.

[mndar]

Thats a good idea. I'll try using iptables to change the ttl of outbound packets on ppp0.
You are right about the TTL thing. The packet corresponding to the PC on the internal network had a TTL of 63 while the one originating from the Linux router had TTL 64.

[mndar]

Thanks Nokia! It worked
Just did

iptables -t mangle -A POSTROUTING -o ppp0 -j TTL --ttl-set 64

Life's good again!
Now its time to figure out how to get my WRT54G to do this. I guess I'm gonna have to install OpenWRT on it

[Nokia]

I know I'm right :P Unfortunatelly, you need either a new ISP or a linux router, as I've already said. Dunno about openwrt. My Tomato can do this only for LAN hosts. Perhaps a script could be loaded...

Here's an idea: Send TTL=65 to your router

[mndar]

Yeah. Thats exactly what i did. Was about to post that.
The ISP is accepting only 2 TTL values, 32 and 64. So I have to set my TTL to either 33 or 65.
Here is a link on how to do it for Windows computers
http://www.talkbroadband.com/article...ur-Default-TTL

[fireball]

To use an overworked phrase: That's awesome, guys! With all the strictures now being imposed by isp's, this would be valueable material for a sticky. I'm going to commit it to my cheat sheet of 'Fedora fixes'. Thanks.

[Nokia]

To use an overworked phrase: That's awesome, guys! With all the strictures now being imposed by isp's, this would be valueable material for a sticky. I'm going to commit it to my cheat sheet of 'Fedora fixes'. Thanks.

Not awesome, just Linux

[mndar]

There is a simpler way to change the ttl.

echo  65 > /proc/sys/net/ipv4/ip_default_ttl

This would of course change the TTL for all interfaces. iptables will allow you to do it for a specific interface.
Here is a better description of the configuration http://mndar.phpnet.us/tutorials/Tips_Tricks/ttl.html or http://www.geocities.com/emailmandar/ttl.html

[bee]

There is a simpler way to change the ttl.

echo  65 > /proc/sys/net/ipv4/ip_default_ttl

This would of course change the TTL for all interfaces. iptables will allow you to do it for a specific interface

Just to know... you need to run this command at each startup?
because, usually, files under /proc aren't fixed files...

bye!

[mndar]

Just to know... you need to run this command at each startup?

Probably Yes. Anyway, I prefer the iptables method.