full-disclosure - Zonet ZSR1104WE Router problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <001901c42def$723535e0$ca00a8c0@HOMELOGIC>
From: jwachtel at homelogic.com (J Wachtel)
Subject: Zonet ZSR1104WE Router problem

Zonet ZSR1104WE

Router does not report inbound connections with their WAN ip address.
All inbound connections are posted as the routers LAN address.

This issue is a simple one.  The ZSR1104WE router with the listed
firmware / hardware will not report an inbound TCP/IP connections WAN
address.  We host a service that uses port 443 @ 192.168.1.2 that is
forwarded through the routers NAT firewall.  Lets say an inbound
connection from 24.156.189.3 establishes a socket connection to the
service on port 443.  Our services IP logging tool and Windows XPPro SP1
netstat command line utility will not report the WAN address of this
connection.  Instead the LAN IP address of the router will be reported
as the inbound connections address.  It is analogous to NAT in reverse.
All inbound connections are masked as the router's LAN IP address.  Our
service and some other tools discriminate security rights depending on
whether the connection is from the WAN or LAN, this behavior makes that
impossible.  The connection will behave normally.  However I speculate
that it is using the MAC address to get the routing correct.  I have
contacted their support to inform them of this error and their response
is to not fix it as it does not break the connection. 

-Jason Wachtel

Zonet ZSR1104WE

Hardware Version   Rev. A 

Boot Code Version   1.0 

Runtime Code Version   2.41

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040429/d30f9ad7/attachment.html