Topic: PvPGN Firewall - DieTesseract
Hi Guys,
Well, have been past almost 6 years from the development of the first solution was some kind of Proxy, but you need a VPS in parallel to run, but was the first step to fix the problem.
The time past and Meanski create for Windows a more simple solution call it D2GS Admin, and it worked really well.
A few days ago a user call MayhemARG post a firewall based in Python in a very basic but functional form.
After asking him a few questions and he make some changes, I decide to take the code and apply a few things that in my experience as admin where necessary.
So here is the new PvPGN Firewall of course DieTesseract.
---
INTRODUCTION
===========
The D2GS have a problem with a Hex code, if you send it, you crash the process, and all the games shut down.-
Tesseract make modifications in theory to avoid this crash and create individual enviroment for every game (D2GS.exe process) - But nobody can make it work, so it's like nothing.-
---
INSTALLATION
===========
Install Python 3.11 or above, then this libraries:
- pydivert
- psutil
For example in Windows, install Python, remember in the installation set "Use Admin privilegies", and "Add Python PATH".
Then in a CMD with admin privilegies type:
pip install pydivert
pip install psutil
Then, just execute like admin Start Firewall.bat, Done!
THE FIREWALL
===========
Very simple information and nothing else in screen, but now comes the important stuff:
GENERAL CONFIGURATION
==================
CONFIG FILE
In the config.json you set the parameters to adjust the firewall, here we have the important variables:
"BAN_DURATION" = Time in minutes the IP that send flood packages or malicious login will be temporary banned.
"MAX_TEMP_BANS" = The max allowed temporal bans the IP can have before get a permanent ban.
"TIME_FOR_MAX_PACKETS" = Time in seconds to not consider flood packets as malicious.
"MAX_PACKETS_THRESHOLD" = It's the number of flood packets allowed in the previously set time.
For example: If TIME_FOR_MAX_PACKETS set to 10, and MAX_PACKETS_THRESHOLD to 12
will allow 12 packets in a range of 10 seconds, this is only for Flood packages.
"BLOCKED_PACKET_THRESHOLD" = It's the max number of malicious packets to count before permanent ban the IP, this apply to port 4000 (D2GS).
"BLOCKED_PORT" = Default D2GS Port, never change.
"LOGIN_PORT" = PvPGN Login port, usually this never change.
"FIREWALL_RESTART" = Set True or False to restart the firewall after a set time (see below) to clear memory.
"FIREWALL_RESTART_HOURS" = Time in hours to restart the firewall, for example 24 (this will be 1 time per day).
"PROCESS_MONITOR" = Monitor the D2GS, True or False. This restart the D2GS.exe if crash for some reason.
"PROCESS_NAME" = The D2GS.exe name to monitor, usually this never change.
"PROCESS_PATH" = The complete folder path of the D2GS remember put doble \\.
PAYLOADS (Hex Codes)
You can set the payloads this are hex codes to stop, you have three files:
payloads.json = This are malicious payloads never go to D2GS process, always drop.
payloads_login.json = This are payloads that make a temporary ban to the IP, codes like like RedVex cheat, in login.
payloads_flood.json = These are payloads that pass, but in excessive quantity are harmful.
In all cases you have two ways to set the payloads inside this files:
starting_with = If the payload start with that code, it's detected.
fixed = It's a complete structure of code, will be detected only if the packet arrive it's exactly like that.
Check the EXAMPLE_payloads.json for more information.
By default you will have inside:
payloads.json = The most common attack hex code
payloads_login.json = The hex code to disable RedVex cheat login.
payloads_flood.json = The overhead chat, to avoid flood, and possible crack of D2GS.
NOTE: If you have only one code for example in starting_with and you don't have any in fixed code, put the same
in the two places, like in the default: payloads_flood.json
PERMANENT BANNED IPs
This go to the file permaban_ips.json you can remove it from there editing the file, for example:
{"172.21.41.6": 1, "186.71.42.3": 1}
You want to remove the 172.21.41.6, you will end with something like this:
{"186.71.42.3": 1}
HOW IT WORKS?
============
In general lines, when you start the firewall this will monitor two ports, the 6112 this is the login PvPGN port, and always check de 4000 port (this is the D2GS port).
You have three kind of payloads the malicious one for D2GS, the payloads for login PvPGN, that never reach port 4000 or 6112, and the flood ones, like the overhead chat, this can reach the game but if it exceeds a certain amount of packets in a certain time it's blocked.
When any of the set hex codes in the payloads files are detected happend two things:
D2GS port 4000: They start to count (BLOCKED_PACKET_THRESHOLD) if the IP reach this number, get a permanent ban, this will be instant block without any analisis and a denied access to the port 6112 (login port).
Login port 6112: They will get a instant temporary, the time it's set in "BAN_DURATION" this will deny access to the port 6112 (login port) for example if try to login with RedVex cheats.
Flood Codes: This codes works with TIME_FOR_MAX_PACKETS and MAX_PACKETS_THRESHOLD if the IP send the max amount of packets in the maximum time permited will get a temporal ban this will be set in BAN_DURATION and will have 1 red flag, if this behavior continues will reach the MAX_TEMP_BANS in that case, that IP will be permanent banned, no more analisis, and block the 6112 (login port).
HOW LOOKS THE LOG FILE?
===================
For example here, we see the start of the Firewall, and the IP was sending the overhead chat:
2023-05-29 - Today it's a new fresh restart in the PVPGN Firewall...
18:20:20 - Flood packet has been detected: b'\x14\x00\x01Hello\x00\x00\x00' - From Source IP: 172.21.41.6
18:20:21 - Flood packet has been detected: b'\x14\x00\x01Hello!!!\x00\x00\x00' - From Source IP: 172.21.41.6
This IP send too many overhead chats, and reach the maximum allowed temporary bans:
18:20:20 - Flood packet has been detected: b'\x14\x00\x01Hellooooooo\x00\x00\x00' - From Source IP: 172.21.41.6
18:20:22 - The IP: 172.21.41.6 was temporarily banned because it sent too many packets.
18:21:20 - Flood packet has been detected: b'\x14\x00\x01Hellooooooo\x00\x00\x00' - From Source IP: 172.21.41.6
18:21:21 - Flood packet has been detected: b'\x14\x00\x01Hellooooooo\x00\x00\x00' - From Source IP: 172.21.41.6
18:21:21 - Flood packet has been detected: b'\x14\x00\x01Hellooooooo\x00\x00\x00' - From Source IP: 172.21.41.6
18:22:22 - The IP: 172.21.41.6 was banned too many times, go to permanent ban.
This IP try to send malicious packets, and it's counting, then get banned and finally try to login with no luck:
18:27:06 - Malicious packet has been detected: b'\xff\x01' - From Source IP: 172.21.41.6 - Send 1 packets
18:27:06 - Malicious packet has been detected: b'\xff\x01' - From Source IP: 172.21.41.6 - Send 2 packets
18:27:07 - Malicious packet has been detected: b'\xff\x01' - From Source IP: 172.21.41.6 - Send 3 packets
18:27:07 - Malicious packet has been detected: b'\xff\x01' - From Source IP: 172.21.41.6 - Send 4 packets
18:27:30 - The IP: 172.21.41.6 was permanent banned, because reach the malicious packet threshold.
18:28:08 - The IP: 172.21.41.6 - Try to login, but have permanent ban.
============================
Thats all, any questions put it in the comments, and I will be glad to help!
Good Luck!
--