[HELP] Blocking TCP RST Packets

[iTpHo3NiX]

asdf

[ande]

Ohh, interesting. This gotta be that company in russia or whatever that DDoS's torrent downloaders to prevent them from downloading. I have no clue how to do it on windows, but if you use linux its easy to block. Alternatively you could setup DDWRT or something like it on your router and block it. I am thinkin iptables at least, should fix it. If it does not i guess you need a connection aware firewall, I use Vuurmuur a lot.

[RedBullAddicted]

As ande said this sounds very interesting. I would love to have a look at that. Do you have wireshark on your box and can you do a capture while this is happening? Don't know about vuurmuur but I used pfsense for a long time. You can run it as vm but you need to make sure that traffic from the internet first needs to pass your firewalling vm before it gets to your computer. If you have some bugs to spare you can buy an alix board and install pfsense on it. Then you can place it behind your router and in front of your pc.

If you have a capture file please pm me and sent it to me. I would really love to see whats going on there 

[iTpHo3NiX]

asdf

[RedBullAddicted]

First this would be box specific. You need to use your linux box with ip tables as gateway for your client. You need to put the linux box in the same subnet then your internet router. Then you need to configure your client with another subnet and afterwards configure routing on the linux box. This makes sure that every network packet regarding your client needs to get through the linux box which filters tcp RST packets. If you want to I can help you with this setup. One more thing to notice... your linux box needs at least two network cards.

[Router 192.168.1.1/24] --- [192.168.1.2/24 Linux Box 192.168.2.1/24] --- [192.168.2.2/24 Windows PC]

[iTpHo3NiX]

asdf

[RedBullAddicted]

ok... if your linux box with ip tables is able to do some kind of dial-in to the internet like PPPoE you are right with the setup. I always forget about the modems cause most routes have them integrated... at least those for home use 

your posted IP is located in England near Chester:
http://iplocation.truevue.org/62.255.200.45.html

lol... NMAPs OS detection is telling that the Device is an Apple IOS device like iphone or ipad.

[iTpHo3NiX]

asdf