Nostr Web Client

I just discovered a fascinating thing.

I've been struggling to solve an internet problem at my parents home for several days, a router and some other stuff cannot connect to internet; the strange part is that my PC and my phone work. My first thought was related to the fact that I use a VPN, but this doesn't make much sense, since VPNs usually are the problem, as they add one more hop to the connection chain.

I did a lot of tests and at the end, exhausted, I decided to order a new cheap router to see if this was the culprit. Today I installed it, same exact problem, damn.

So I noticed that the modem has a diagnostic area with the usual ping and traceroute tools, and I tried them: "unknown host".

This is really crazy, all the WAN/LAN are down, the modem itself cannot see the internet, but with my PC I can connect around and shitpost on Nostr?

So I contacted my ISP and discovered that they suddenly, and without any alert (bastards), disabled the line because there was an unpaid invoice from months ago for an unknown reason, and they are not smart enough to use the credit card they already have to automatically pay it.

Here comes the most interesting part: how does a VPN bypass the administrative suspension on a line and give me free internet?

Did I exploit a huge hole in my ISP (and who knows how many others) infrastructure?

Can any networking guru explain this?

Reply to this note

Please Login to reply.

Discussion

HoloKat 4mo ago

Congrats on their free internet! 😆

DagzTagz 4mo ago

Hmmm... we're your phone and PC using the same VPN connection and perhaps hopping from the private relays on your phone? So essentially your PC was then piggy backing off your phones data

daniele 4mo ago

Both the PC and the phone were connect to wifi, no phone data.

DagzTagz 4mo ago

Ahhh weird af… maybe your VPN is stealth. Sometimes my proton stealth can get around rlly low level packet inspections

DagzTagz 4mo ago

Should also note that this would like be if you are in the Apple ecosystem and have certain permissions set… like if your using a Mac and iPhone

Apple continuity sometimes will create auto connections if you have permissions set … ie, your Mac auto connects to your iPhone systems when home internet is down but your VPN masks the root of the connection making it look like your PC is connected to your home internet (but it’s actually not it’s being throttled by the ISP)

Your Apple ID being set up on both would/could create this continuity through Bluetooth/hotspot/etc and your obfuscation methods might make it look different unless you were doing like a deep packet inspection… DNS or lower

Android or Linux distros would be totally different though

daniele 4mo ago

I use Android.

DZC 4mo ago

It depends how the ISP "disabled" the line.

Maybe they just blocked access to their DNS (or even to any other DNS), and having the VPN connection you could connect with no problems to other DNS and then to wherever else in the internet because other ports were not blocked?

Can you do some nmap scan to detect which communication is blocked?

daniele 4mo ago

At the beginning of my tests I also tried to change the DNS, and then pinging directly a remote IP; the issue is not related to the domains resolution.

How can I use nmap to find something useful here?

DZC 4mo ago

By no means am I any expert, but I found that you can try scanning with:

$ sudo nmap -sS -Pn -T5 -p- [target- ip]

ChipTuner 4mo ago

ISPs love to block traffic based on remote ports. Do they also have a cable or telephone subscription on the same service and just had an internet bill that was overdue? If so, they may have wanted to keep traffic open for cable or phone services while best effort blocking common traffic like http and stuff?

"unknown host" is usually a dns resolution failure, where you simply having DNS resolution failures?

cloud fodder 4mo ago

this, it prob means dns was turned off, and your devices had it cached.

ᴛʜᴇ ᴅᴇᴀᴛʜ ᴏꜰ ᴍʟᴇᴋᴜ 4mo ago

the VPN had an IP address so it didn't need that, and then the devices were going through the VPN to get DNS. this is normal with stuff like wireguard, usually you set one or two DNS IP addresses to use with it and they get elevated to higher priority (lower metric) than the rest of the connections and it goes through the VPN for it.

pretty funny that the ISP was blocking their access just by blocking DNS tho. but that above is the reason why the VPNed devices were getting through, everything until a non-firewalled outbound was going via IPs.

daniele 4mo ago

It's not a DNS issue since:

nostr:nevent1qvzqqqqqqypzq77777lz9hvwt86xqrsyf2jn588ewk5aclf8mavr80rhmduy5kq9qydhwumn8ghj7cmgwfhku6trd3jjuer5dahx7m3wvdhk6tcppemhxue69uhkummn9ekx7mp0qqsyvgkpvvvkhaxyrqm03mjs3wq45qyel2z47fnmzmnjhfxw39xpaecmz05ag

And pinging an IP from the modem gives a "timeout" error.

More probably they are blocking all the TCP connections, and WireGuard works over UPD (right?).

ᴛʜᴇ ᴅᴇᴀᴛʜ ᴏꜰ ᴍʟᴇᴋᴜ 4mo ago

port 53 was being blocked. the port being used by the VPN was not, and once it was in the VPN it was outside the firewall.

daniele 4mo ago

No:

> And pinging an IP from the modem gives a "timeout" error.

ᴛʜᴇ ᴅᴇᴀᴛʜ ᴏꜰ ᴍʟᴇᴋᴜ 4mo ago

ICMP goes on a port also that they probably block

ᴛʜᴇ ᴅᴇᴀᴛʜ ᴏꜰ ᴍʟᴇᴋᴜ 4mo ago

actually, i lied. ICMP messages can be dropped by one of the next hops in the path.

you'd have to tracepath/traceroute to find out how far into their network you can get

also they may have allowed UDP in general, or at least not blocked it on whatever paths or ports.

there are tools to explore all of this if you are curious.

you didn't say what kind of VPN you were using also. some use UDP. that's why i suggested that also.

i get why you are interested though. this ISP's security guys are obviously lazy or stupid.

daniele 4mo ago

From the modem I can also fire a traceroute, it immediately returns a timeout.

Instead dig works.

I told that in a previous repky, the VPN uses WireGuard.

It seems to me a classic Occam's razor situation.

ᴛʜᴇ ᴅᴇᴀᴛʜ ᴏꜰ ᴍʟᴇᴋᴜ 4mo ago

that was just a guess it was wireguard. https://search.brave.com/search?q=wireguard+udp&source=desktop&conversation=6aea02d872b7fd5286fdd0&summary=1

it is possible that they were not blocking UDP and it generally uses random high ports.

wireguard is awesome btw. i use it all the time.

daniele 4mo ago

nostr:nevent1qqsr5lzxjpkv50w6dylng2k37n2ntj6lv2eh6l30g25j3q075rgxy3qpz4mhxue69uhhyetvv9ujuerpd46hxtnfduhsygrmmmmmugka3evlgcqwq3922wsul966nhrayl04svauwldhsjjcq5psgqqqqqqsdcq604

ᴛʜᴇ ᴅᴇᴀᴛʜ ᴏꜰ ᴍʟᴇᴋᴜ 4mo ago

btw, HTTP/3 also uses UDP, but not many servers support it yet. not sure how good browser support is either. but it's awesome, like, so nostr uses http/1 or http/2 websockets, the equivalent with http/3/QUIC is "WebTransport" which is far better - not only is it over UDP, the sockets multiplex so where previously clients might open 5 separate websocket connections, each of them taking like 200ms of upgrade negotiation, with WebTransport it's one connection and i could be misremembering but the upgrade is not a round trip, you just fire off the open and then follow straight up with your requests and each goes on a separate part of the multiplexed connection.

probably is a couple years more before WebTransport and HTTP/3 are in common use but obviously this ISP will have to update their network security

ChipTuner 4mo ago

Yeah caught that unknown host part right before I smacked the sign button, agreed.

daniele 4mo ago

It's not a DNS block, since I tried to change them and also ping directly some IPs.

Pinging a IP from the modem gives "Request timed out".

I'm connected via WireGuard; maybe they are blocking TCP connections, or selected ports.

ChipTuner 4mo ago

Hmm, In that case if you have the motivation, id try some port knocking and see what happens. Otherwise yeah, could be TCP specifically, although I can't see a case where they would want to block blanket L4 traffic like that.

𝖋𝖎𝖆𝖙𝖉𝖊𝖓𝖎𝖊𝖗 (¯`◕‿◕´¯) 4mo ago

Your PC was using your phone.

GelatoEconomist 4mo ago

TCP/IP hurts

Alessio 4mo ago

The name of ISP?? 😀😀😀

daniele 4mo ago

The main Italian ISP 🙄

Alessio 4mo ago

E quale VPN usi? Intendo il servizio da chi offerto? Perché da quanto ho capito la vpn è wireguard.