Hinder nmap OS Fingerprinting

Banana Pi Router design OpenWRT One(MT7981)/BPI-R2 Mini
1

You can disable TCP Timestamps to make it harder to fingerprint the router’s OS, but that comes with tradeoffs that are unacceptable on faster connections.

But, we can ‘mangle’ all packets to make them generic-looking.

Let’s make all packets exiting the wan interface appear to have the TTL and hop_limit of a Windows computer.

If you issue:

sysctl net.ipv4.ip_default_ttl

… and:

sysctl net.ipv6.conf.all.hop_limit

… you’ll see the ttl and hop_limit are set to the Linux default of 64.

Now, we could try just changing those settings in the configuration files… but the IPv4 settings only apply to packets originating from the router. They completely ignore forwarded traffic (which will have its own TTL or hop_limit based upon the device originating those packets). If a laptop or smartphone sends a packet through the router to the internet, OpenWRT simply decrements that packet’s original TTL by 1. Attackers scanning your WAN can still map out every device behind your router by reading those unaltered, passed-through TTLs.

So let’s set the TTL to 128 (the Windows default).

First, create the file we’re going to use:

touch /etc/nftables.d/99-obfuscate.nft

Then edit the file:

vi /etc/nftables.d/99-obfuscate.nft

Press i to enter editing mode, the input the following:

# Set TTL (IPv4) and hop_limit (IPv6) to 128
chain mangle_out {
    type filter hook postrouting priority mangle; policy accept;
    ip ttl set 128
    ip6 hoplimit set 128
}

… press Esc to exit editing mode, then press :wq to save and exit.

Reload the firewall:

fw4 reload

To make sure it works, go to:

https://browserleaks.com/tcp

… you should see:

Initial TTL	128

You can also issue:

sysctl -w net.ipv4.tcp_wmem="4096 65536 4194304"

Then:

vi /etc/sysctl.conf

… press i to enter editing mode, then input:

net.ipv4.tcp_wmem="4096 65536 4194304"

… then press Esc to exit editing mode, then :wq to save and exit.

That sets the default TCP send buffer to mimic Windows behavior.

Note that at:

https://browserleaks.com/tcp

… I now have a Zardaxt OS fingerprinting scoring of:

Zardaxt OS Scoring	Android (47%), Linux (42%), Windows (27%), macOS (8%), iOS (7%)

… IOW, the OS fingerprinter is completely confused.