Hinder nmap OS Fingerprinting

Banana Pi Router design OpenWRT One(MT7981)/BPI-R2 Mini
1

[ EDIT 1 - updated /etc/nftables.d/99-obfuscate.nft… the prior version messed with IPv6 NDP and ICMP6, which caused IPv6 to drop to link-local only. ]

You can disable TCP Timestamps to make it harder to fingerprint the router’s OS, but that comes with tradeoffs that are unacceptable on faster connections.

But, we can ‘mangle’ all packets to make them generic-looking.

Let’s make all packets exiting the wan interface appear to have the TTL and hop_limit of a Windows computer.

If you issue:

sysctl net.ipv4.ip_default_ttl

… and:

sysctl net.ipv6.conf.all.hop_limit

… you’ll see the ttl and hop_limit are set to the Linux default of 64.

Now, we could try just changing those settings in the configuration files… but the IPv4 settings only apply to packets originating from the router. They completely ignore forwarded traffic (which will have its own TTL or hop_limit based upon the device originating those packets). If a laptop or smartphone sends a packet through the router to the internet, OpenWRT simply decrements that packet’s original TTL by 1. Attackers scanning your WAN can still map out every device behind your router by reading those unaltered, passed-through TTLs.

So let’s set the TTL to 128 (the Windows default).

First, create the file we’re going to use:

touch /etc/nftables.d/99-obfuscate.nft

Then edit the file:

vi /etc/nftables.d/99-obfuscate.nft

Press i to enter editing mode, the input the following:

chain mangle_out {
        type filter hook postrouting priority mangle; policy accept;

        # 1. Obfuscate wan-oubound IPv4 traffic
        ip ttl set 128

        # 2. Obfuscate wan-outbound IPv6 traffic
        #  while protecting RFC 4861 local protocols
        # (NDP, ICMPv6), which must have hoplimit=255
        ip6 nexthdr != icmpv6 ip6 hoplimit set 128
}

… press Esc to exit editing mode, then press :wq to save and exit.

Reload the firewall:

fw4 reload

To make sure it works, go to:

https://browserleaks.com/tcp

… you should see:

Initial TTL	128

You can also issue:

sysctl -w net.ipv4.tcp_wmem=4096 65536 4194304

Then:

vi /etc/sysctl.conf

… press i to enter editing mode, then input:

net.ipv4.tcp_wmem=4096 65536 4194304

… then press Esc to exit editing mode, then :wq to save and exit.

That sets the default TCP send buffer to mimic Windows behavior.

Note that at:

https://browserleaks.com/tcp

… I now have a Zardaxt OS fingerprinting scoring of:

Zardaxt OS Scoring	Android (47%), Linux (42%), Windows (27%), macOS (8%), iOS (7%)

… IOW, the OS fingerprinter is completely confused.