NEFilterDataProvider's NENetworkRule not working for netcat(nc)

Question

faisalIkwal OP

Created Feb ’23

Replies 2

Boosts 0

Participants 1

Hi, I have applied below rule

let filterRules = ["0.0.0.0", "::"].map { address -> NEFilterRule in
      let localNetwork = NWHostEndpoint(hostname: address, port: "0")
      let networkRule = NENetworkRule(remoteNetwork: nil,
                          remotePrefix: 0,
                          localNetwork: localNetwork,
                          localPrefix: 0,
                          protocol: .TCP,
                          direction: .any)
      return NEFilterRule(networkRule: networkRule, action: .filterData)
    }

I have written below code in method: override func handleInboundData

if remoteEndpoint.hostname == "10.207.135.79" {
        os_log(.debug, log: self.log, "dropping for 10.207.135.79.");
        return .drop()
}

From device 10.207.135.79 i am trying to send TCP as below:

1. ssh userName@10.213.175.1

It is getting drop as expected. kex_exchange_identification: Connection closed by remote host

2. Send via netcat(nc) nc 10.213.175.1 8888

During netcat, it's not getting drop.

3. Send via curl(nc) curl 10.213.175.1:8888 During curl, it's not getting drop.

10.213.175.1 is IP where system extension filter provider running.

is this expected behaviour?

Boost

Answer 1

faisalIkwal OP

Feb ’23

I have added dropping 10.207.135.79 in method override func handleOutboundData as well

0

Answer 2

faisalIkwal OP

Feb ’23

Hi, By mistake i have pasted wrong code of filter rule. I don't see any option to edit post hence replying.

I have applied rules on remote as below.

let filterRules = ["0.0.0.0", "::"].map { address -> NEFilterRule in
      let remoteNetwork = NWHostEndpoint(hostname: address, port: "0")
      let networkRule = NENetworkRule(remoteNetwork: remoteNetwork,
                          remotePrefix: 0,
                          localNetwork: nil,
                          localPrefix: 0,
                          protocol: .TCP,
                          direction: .any)
      return NEFilterRule(networkRule: networkRule, action: .filterData)
    }

0