0

I am doing a security research related to the damage you can do if you control the router. I need to be able to close/reset a established connection from one client while sitting on the router.

To be more specific, I need to kill the connection between a client and the Apple Push notification server (APNS). The reason is that I want to be able to prevent the client from communicating with APNS. I tried using iptables but it won't work on established connections.

Given that there is a established connection to APNS from the moment the client turns on his Macbook, by the time I compromise the router it's to late.

I tried iptables, to change the arp table, used the "route" and "ip route" commands. Nothing worked...

How can I kill a established connection when I control the router so I can add rules to iptables that prevent a new connection?

I will add that I do not want to install new tools like tcpkill or cutter. I would like to find a way to do this with the tools that come in the OS out of the box on distros like dd-wrt and openwrt.

1 Answer 1

1

Approach:

  1. Block NEW connections from your target with iptables. You are already doing this.
  2. Delete all conntrack state for the existing connections from your victim

For step 2, you want to use: conntrack - command line interface for netfilter connection tracking (man conntrack)

In debian/ubuntu, you can install the package conntrack.

And now, just delete the state for your victim.

conntrack -D -s src -d dst
conntrack -D -s dst -d src

Since your victim can't establish new connections (yes, iptables conntrack will now consider the packets from the existing connection as NEW), you achieved your goal.

By the way, conntrack -F is your friend when experimenting with state.

2
  • Thanks for your answer @corny. One of my restrictions is installing tools. I do not want to install anything in the router I am compromising and ideally want to find a way to do it with the common tools that come in small linux distros like dd-wrt or openwrt. Apart from the conntrack, I saw other tools like tcpkill and cutter which could achieve the same thing but I will prefer not to install anything and work with what the OS provides out of the box. Thanks again!
    – martinvigo
    Aug 26, 2016 at 20:46
  • I just straced the conntrack tool, it is remarkably simple: it just tells the kernel what to do over an PF_NETLINK NETLINK_NETFILTER socket. You can probably implement this yourself in python (which is available on your router?) or compile the conntrack-tool as static binary for your router.
    – corny
    Aug 26, 2016 at 22:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .