Mencegah User Agar Tidak Bisa Membuka LAN Setting Pada Window Dengan Hide Tool

Terkadang ada diantara beberapa user yang sekedar iseng mengganti ip-address nya sendiri, entah ingin tahu atau ada maksud lain. Tetapi pada sisi admin dan system hal tersebut sedikit menjengkelkan karena dengan bergantinya ip address tersebut ada beberapa konfigurasi yang tidak berjalan dengan semestinya.

Dengan Aplikasi Hide Tool ini, itu bisa diamankankan dengan menutup dialog box Internet Protocol (TCP/IP) pada LAN Connection Properties.

Bagi anda yang belum mengetahui tentang Hide Tool, silahkan membuka artikel pada blog ini. Download dan install Aplikasi tersebut.

Dirty NAT tricks to get a VPN to work with clients also numbered in the private address space

The Problem

You have a corporate LAN. You want to set up a VPN (in this case OpenVPN) into the LAN for your road-warriors. However, your LAN is numbered with one of the very common private subnets, such as 192.168/16. Your road-warriors often get addresses in the same private subnet from their coffee-shops, and this breaks things horribly. This is illustrated in the diagram below.
I'm going to use specific IP addresses and interface names on this page, since too often I find when people try to describe the general solution it actually makes it less clear and harder to apply to your own network.

NAT detection

NAT detection is the process of determining hosts running Network Address Translators (NATs).

Contents  [hide] 1 Approaches 1.1 Active detection 1.1.1 Port scanning 1.1.2 Routing test 1.2 Passive detection 1.2.1 IP TTL 1.2.2 Leaked real IP address 1.2.3 Strict source port translation 1.2.4 OS fingerprinting 2 Tools 3 Links 3.1 Non-English

Approaches

Active detection

Port scanning

Some software NAT solutions (such as Kerio WinRoute Firewall), as well as many hardware solutions, provide a control port, which allows users to monitor and control their server (e.g. using a web browser). These control ports can be easily detected by means of port scanning (see Nmap).

Routing test

Some improperly configured NATs allow IP packets to be translated from an external network. Routing test can detect these translators by trying to contact external server (e.g.forensicswiki.org:80) with modified routing tables.

Passive detection

IP TTL

Network Address Translators decrement IP TTL values of all translated packets.

Detecting NAT Devices using sFlow

Overview

Unauthorized NAT (Network Address Translation) devices can be a significant security problem. Typically the NAT device will appear to the network administrator as an end host and it will authenticate itself onto the network. However, the NAT device provides unrestricted access to any number of hosts connecting to it directly, or more troublingly via wireless (Wi-Fi 802.11). Wi-Fi is a particular problem since it allows access to the network from a considerable distance, allowing unauthorized access without even entering the building.
Reliably detecting NAT devices is difficult since they are virtually indistinguishable from legitimate hosts. This paper describes how the detailed, pervasive, traffic monitoring capabilities of sFlow (RFC 3176) can be used to identify NAT devices on a network.

How to prevent NATed access

Sesuai dengan judul diatas,
inti dari kasus ini adalah penyedia jasa tidak ingin BW yang diberikan kepada user di sharing lagi mempergunakan nat-router.

Ilmu baru buat saya, dengan memberikan TTL=1 ?, mmmm aneh sekali.

Hasil dari googling di wikipedia di dapat informasi sebagai berikut :

The TTL field is set by the sender of the datagram, and reduced by every host on the route to its destination. If the TTL field reaches zero before the datagram arrives at its destination, then the datagram is discarded and an ICMP error datagram (11 – Time Exceeded) is sent back to the sender.

Supaya tidak hilang ditelan hari, dikopi saja ke situs

Diambil dari http://forum.mikrotik.com/viewtopic.php?f=9&t=19484

/ip firewall mangle

add action=change-ttl dst-address=192.168.1.0/24 \

chain=forward new-ttl=set:1

Maksud dari baris perintah diatas, adalah paket yang lewat router mikrotik hanya dibuat valid untuk 1 hop berikutnya ke arah klient, yang berarti hanya valid untuk 1 pc, karena begitu masuk ke PC tersebut TTL berkurang 1, sehingga menjadi 0.

Jangan lupa, peletakan firewallnya harus dibaris yang tepat, bila tidak tepat rule ini tidak akan terbaca.

Bila mempergunakan linux dan iptables, maka panduan-nya ada di milist linux ini.

Configure TCPIP settings for better performance

Description of what TCP/IP settings to configure for better performance and quality connection. These settings are configured through the Windows registry, but there also exist utilities to easily configure these settings:

• DSLReport's DrTCP - Utility to configure the most common settings (Recommended).
• SpeedGuide's TCP Optimizer - Utility to configure almost everything and includes a connection speed tester to give recommendations
• If wanting to get your hands dirty, then here are details of where to go in the registry:
• Registry settings for the TCP/IP stack Win9x / WinNT
• Registry settings for the MTU size Win9x / WinNT