Temporary Connectivity Fix for Linux Users

[Choochootrain]

Thanks to the awesome work of Tinmann in this post:

https://octowow.st/forum/viewtopic.php? ... =50#p16470

It would seem that the connection issues for Linux users stems from the hosting provider responsible for the 92.114.107.0/25 IP addresses using traffic fingerprinting. If the server fingerprints you as Linux, then it won't even respond. Tinmann's solution is the "mangle" the TCP headers for any traffic to any 92.114.107 IP and set the TTL to 128, thus making the traffic look more "windows-ish" (I guess).

He used iptables to accomplish this. Because I'm on a newer Fedora install, I wanted to avoid using iptables. Instead, I was able to implement it using firewalld/firewall-cmd as follows:

Code: Select all

>>] sudo firewall-cmd --permanent --direct --add-rule ipv4 mangle OUTPUT 0 -p tcp -d 92.114.107.0/25 --dport 3724 -j TTL --ttl-set 128
[sudo] password for *****: 
success
>>] sudo firewall-cmd --reload
success

Then, to test if it has been set:

Code: Select all

>>] sudo firewall-cmd --direct --get-all-rules
ipv4 mangle OUTPUT 0 -p tcp -d 92.114.107.0/25 --dport 3724 -j TTL --ttl-set 128

I'm a little worried that this is still not an actual fix, since all we are doing is evading the identification of Linux traffic. The ultimate problem is they're using "Linux traffic is DDoS traffic" as a heuristic. Yeah, it probably works, but it's killing us legit players on Linux.

I certainly hope the devs pay attention to this and sort it out.

[Alhazred1691]

Thank you for helping your fellow linux nerds. I'm not enough of a nerd to fully understand this and/or I do fully understand it and it seems stupid that I have to do this just to level my mage.

Anyway. My question is should I implement this solution in addition to hardcoding the IP in realmlist.wtf or instead of changing the IP? I've only changed the realmlist and it's worked on both linux machines I use.

Thank you Octowow for helping me learn more about networking on linux.

[Choochootrain]

This solution should allow you to leave your realmlist file alone. That is, just let the launcher clobber it with play.octowow.st and it should just work.

What it's doing is making your traffic "look" like non-Linux traffic, so the DDoS prevention doesn't block you right away. Will it continue to work, long term? No idea. But, it should work longer than hard-coding a particular IP in the realm list file.

[Tuckmarshf]

This is getting annoying
I was checking traffic, I would have never assumed they would block due to the TTL.

Thank you for this fix, Choochootrain.