Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Mangle TTL

    Scheduled Pinned Locked Moved Firewalling
    5 Posts 3 Posters 800 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      james_h
      last edited by

      Is there any way to mangle TTL similar to below, from the GUI?

      /sbin/iptables -A PREROUTING -t mangle -i eth1.10 -d 239.255.255.250 -j TTL --ttl-set 4

      1 Reply Last reply Reply Quote 0
      • GrimsonG
        Grimson Banned
        last edited by

        Use this: https://forum.netgate.com/search you're not the first one asking this question.

        1 Reply Last reply Reply Quote 0
        • J
          james_h
          last edited by

          Thanks already tried that will have another look...

          1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate
            last edited by

            No.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 0
            • J
              james_h
              last edited by

              Thanks,

              For anybody interested in trying this via CLI, here is how I did it by adding mit-ttl 4 to the line below:

              0_1545063408555_48d44bc3-e84e-4ea4-8072-d5abc846f7ea-image.png less /etc/inc/filter.inc | grep scrub
              $rules .= filter_generate_scrubing();
              function filter_generate_scrubing() {
              $scrubrules = "";
              $scrubrules .= "scrub from any to <vpn_networks> max-mss {$maxmss}\n";
              $scrubrules .= "scrub from <vpn_networks> to any max-mss {$maxmss}\n";
              /* disable scrub option */
              foreach ($FilterIflist as $scrubif => $scrubcfg) {
              if (isset($scrubcfg['virtual']) || empty($scrubcfg['descr'])) {
              if (($scrubcfg['mss'] <> "") &&
              (is_numeric($scrubcfg['mss']))) {
              $mssclamp = "max-mss " . (intval($scrubcfg['mss'] - 40));
              if ($config['system']['scrubnodf']) {
              $scrubnodf = "no-df";
              $scrubnodf = "";
              if ($config['system']['scrubrnid']) {
              $scrubrnid = "random-id";
              $scrubrnid = "";
              if (!isset($config['system']['disablescrub'])) {
              $scrubrules .= "scrub on ${$scrubcfg['descr']} all min-ttl 4 {$scrubnodf} {$scrubrnid} {$mssclamp} fragment reassemble\n"; // reassemble all directions
              $scrubrules .= "scrub on ${$scrubcfg['descr']} {$mssclamp}\n";
              return $scrubrules;

              Changes were confirmed by:

              0_1545063485692_dec7e2b4-3b5e-4fd8-8edb-900371f0cc6c-image.png

              pfctl -sr | grep scrub
              scrub on pppoe1 all min-ttl 4 fragment reassemble
              scrub on em0.5 all min-ttl 4 fragment reassemble
              scrub on em0.10 all min-ttl 4 fragment reassemble
              scrub on em0.20 all min-ttl 4 fragment reassemble
              scrub on ovpnc6 all min-ttl 4 fragment reassemble
              scrub on em0.50 all min-ttl 4 fragment reassemble
              scrub on em0.60 all min-ttl 4 fragment reassemble
              scrub on em0.11 all min-ttl 4 fragment reassemble
              scrub on em0.40 all min-ttl 4 fragment reassemble
              scrub on ovpnc2 all min-ttl 4 fragment reassemble
              scrub on ovpnc3 all min-ttl 4 fragment reassemble
              scrub on em0.80 all min-ttl 4 fragment reassemble
              scrub on ovpnc4 all min-ttl 4 fragment reassemble
              scrub on em0.7 all min-ttl 4 fragment reassemble

              I am actually going to revert this change and use a separate VM for the multicast reflection and manipulation I am trying to achieve to have a Set Top Box and Speakers in a separate IOT VLAN.

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.