What header fields in IP, TCP and ICMP packets do NOT get altered in general by firewalls and NAT/gateways, both state-ful and not?

Question

I need to determine which header fields in IP, TCP and ICMP packets will never (at least, in 99% of cases, excluding perhaps a bizarre overly-aggressive firewall) be altered by a firewall or NAT/gateway device, including both stateful and stateless.

For instance, I have observed that certain headers will be manipulated by the firewall/NAT device, such as the window size, or the presence of the PSH and URG flags. I believe even the 'data offset' ('doff' name in the TCP header struct) was affected at some point as well. How common are these manipulations for firewalls and NAT devices?

Those that I know shouldn't ever be changed, at least that I've observed and am looking for confirmation from the community here, are the TCP sequence ID#, the IP ID, the ICMP type, ICMP code, ICMP id/sequence # (when in ECHO), and I'd imagine the ICMP data.

Am I incorrect in thinking the TCP window size is manipulated by some firewall/NAT? What about the IP TTL? Would this be manipulated by a border device before reaching its destination?

Any other information about what headers are manipulated and what ever are not is much appreciated.

Answer 1

You are probably developing the new way of hidden tunneling )

As to the fields of IP, TCP, ICMP headers - you can't be absolutely sure that they will be untouched traveling the network. It mostly depends of source and destination network topology, security measures and network equipment or software. Even, the direction of traffic matters. It much differs when traffic flows for ex. from home network to your VDS server or from corporate PC to google server behind load balancer etc..

• IP destination address as well as TCP/UDP destination port are likely untouched unless destination is behind the NAT or load balancer
• TCP SEQ|ACK can be sometimes altered by some firewalls (Cisco ASA randomizes them to prevent session hijacking and other attacks)
• Data offset is likely untouched unless traffic flows through sofisticated firewall
• Most of ICMP types and codes are blocked by typical firewall except Echo request|reply, destination unreachable and TTL expired in transit useful for traceroute
• Payload of ICMP echo and SEQ are likely untouched.
• Payload of TCP is typically untouched by firewall excepting some tricky cases (ALG gateways which modifies FTP, SIP etc, or HTTP/FTP proxies). But most of ports are blocked by corporate firewalls and others forwarded to proxies.
• TCP flags are typically untouched but TCP session follows some rules (handshake etc), so firewall (stateful) watches them and drops invalid or unrelated packets
• DF bit in IPv4 packet is typically untouched, probably other fields such as length and offset, but the packet should be of right size to be passed through
• QoS bits can be modified or completely zeroed traveling the public network.

Well, your question is the reverse-engineering research in a way. Appreciate you share your experience afterward.

Answer 2

Much of what you ask depends on the way a device is configured, and there is not a single answer to your question.

For IPv4, a router will, by default, only change the TTL and Header Checksum fields, unless a packet needs to be fragmented. Fragmentation will change other fields, e.g. Fragment Offset. IPv6 does away with the Header Checksum and fragmentation, so a router will change the Hop Limit field.

Firewalls do not need to NAT, nor does NAT need to happen on a firewall. There are different types of firewalls. If you route on your firewall, then the router part of the firewall will change the same fields as a router. Many firewalls are transparent firewalls. You could have a firewall that proxies TCP, but that is not universal. In such a case, the firewall ends up as the TCP endpoint for both ends of the desired TCP connection. What gets changed in such a situation depends on the vendor and configuration. Something like this could happen on a server load balancer, too.

NAT changes the source or destination IP addresses and/or port numbers, depending on how you have NAT configured. There are various ways of using NAT, and what gets changed depends on the NAT method. Changing anything in the packet header requires the Header Checksum field to be recalculated.