Are Asus routers running ASUSWRT-Merlin affected by NAT Slipstreaming? Mitigations?

[ColinTaylor]

I do have rmmod on my AC-68U. Most likely installed by Entware.

It's included as part of the base firmware (/sbin/rmmod).

 

[heysoundude]

Who still uses FTP these days?

SFTP, yes, I do; daily, and in some cases hourly, both in and out. The S is key...see what I did there?

 

[Wycleff]

1.
Disabled everything in WAN -> NAT Passthrough.

2.
Also added:

modprobe -r nf_nat_ftp
modprobe -r nf_conntrack_ftp

to /jffs/scripts/firewall-start

3. In Terminal
nvram set vts_ftpport=0
nvram commit

No drawbacks/errors/speed issues with Alexa/IOT and other stuff so far. My VOIP-Phone is also working as intended.

Update: 03.03.21
VoWifi on Xiaomi is not working correctly
(also Icon is not visible in Phone UI)

 

[bacon612]

1.
Disabled everything in WAN -> NAT Passthrough.

2.
Also added:

modprobe -r nf_nat_ftp
modprobe -r nf_conntrack_ftp

to /jffs/scripts/firewall-start

3. In Terminal
nvram set vts_ftpport=0
nvram commit

No drawbacks/errors/speed issues with Alexa/IOT and other stuff so far. My VOIP-Phone is also working as intended.

Update: 03.03.21
VoWifi on Xiaomi is not working correctly
(also Icon is not visible in Phone UI)

Any updates on VoWifi issues? I'm on a OnePlus 8Pro and am having issues with VoWifi intermittently dropping. Call quality on VoWifi also doesn't seem to be the greatest, either. Rt ax88u in use. Interestingly, switching back to rt 3100ac on stock setting fixes the issue for me.

 

[Wallace_n_Gromit]

Any updates on VoWifi issues? I'm on a OnePlus 8Pro and am having issues with VoWifi intermittently dropping. Call quality on VoWifi also doesn't seem to be the greatest, either. Rt ax88u in use. Interestingly, switching back to rt 3100ac on stock setting fixes the issue for me.

I know that my Amazon Echo device will not work without 2 items still having NAT Passthrough enabled... unless newer firmware has solved that issue (haven't tested it recently). Perhaps your device still needs Passthrough enabled on One or More services?

..or maybe try this site which refers to a memory management issue: https://docs.epicollect.net/mobile-application/xiaomi-troubleshooting

 

[bacon612]

I know that my Amazon Echo device will not work without 2 items still having NAT Passthrough enabled... unless newer firmware has solved that issue (haven't tested it recently). Perhaps your device still needs Passthrough enabled on One or More services?

..or maybe this site refers to a memory management issue: https://docs.epicollect.net/mobile-application/xiaomi-troubleshooting

View attachment 43561

The image above shows your cuttent NAT settings? To be clear VoWifi is working for you with these settings or not?

 

[Wallace_n_Gromit]

The image above shows your cuttent NAT settings? To be clear VoWifi is working for you with these settings or not?

Yes, those are my current NAT Passthrough settings. Without those settings my Amazon Echo would not function.

I'm just suggesting that (if NAT Passthrough is the culprit) having ALL NAT Passthrough disabled may not work for some cases like myself and perhaps you.

I don't have VoWiFi (Voice over WiFi?). So some experimentation with enabling ALL NAT Passthrough (and seeing if VoWiFi works right) THEN disabling NAT Passthrough one by one and seeing what item(s) are causing the problem.

Once you identify the REQUIRED NAT Passthrough item(s) that must be enabled to operate VoWiFi properly THEN you can again disable the other NAT Passthrough items.

 

[RMerlin]

Some Wifi Calling providers use IPSEC, so you need to enable that passthrough if this is the case for your provider.

 

[bluepoint]

Some Wifi Calling providers use IPSEC, so you need to enable that passthrough if this is the case for your provider.

At least in the US, wifi calling uses IPSEC passthrough.

 

[ttgapers]

I've disabled all so far with no issue. I just need to add the lines to disable the FTP ALG once and for all.

Will report if any other users reports anything on my end.

Thanks for this heads up. I wonder if this can be added to a Skynet etc. best practice for hardening. I know @Adamm already includes disabling WAN access etc as part of the Skynet script checks.

Cheers again and thanks for this.

 

[Mogsy]

Hello,

How to disable FTP ALG please? When I enter 0 I get

Please enter a value between 1 to 65535

 

[Wallace_n_Gromit]

Hello,

How to disable FTP ALG please? When I enter 0 I get

Please enter a value between 1 to 65535

Look at the prior post #23 by @Wycleff in this thread...

Look at item [3. In Terminal] << you have to be in a SSH session on your router.

After you enter those 2 commands try:
nvram get vts_ftpport
0 << this is the result you should see if your ftpport is now "0" (which will also show the same "0" on the asuswrt FTP ALG port GUI)

 

[Unisoft]

I disable all those options and even change the default port for FTP_ALG.

Ring Cameras, SIP VOIP to DECT phone all work fine. Not found a case yet where its broken something.