Yo dawg, we heard you like NATs so ...

... seriously, that was the first thing which crossed my mind when I saw it.

But first things first.

My school got a semi-public WLAN some time back. Semi-public because it's basically BYOD, you just need a valid user/pass combination which any pupil and teacher has.

And that worked fine for a while, until something broke, of course. First there was the packet loss which our tech support (a company contracted for our school) attributed to a faulty router.

They fixed that, only to break DNS, partially - if you used another port but 53 for DNS requests, everything still worked.

Then they installed a filter software which then promptly proceeded to block sites like Youtube, Microsoft.com and Wikipedia. Because of "adult content". And, yes, the filter applied to us teachers as well.

Then camed the MITM attack - they obviously wanted to be able to do DPI which is somewhat difficult when dealing with HTTPS. So the router intercepted the handshake and tried to push its own certificate onto the client. That was the point at which I threatened legal action, by the way.

And now this. The WLAN was broken (once again) and I wanted to see if I was able to get an idea of what was wrong this time. Okay, DNS requests are kind of flakey - sometimes I get a response, sometimes not (they use Google DNS, i.e. 8.8.8.8, by the way). Pinging an IP address directly works. But when I actually request a page through a browser or something like curl, I run into connection problems.

Okay, just for shits and giggles, let's do a tracert to see where the packets are actually routed...

1 5 ms 3 ms 4 ms 172.17.0.12 2 8 ms 3 ms 4 ms 192.168.205.1 3 9 ms 4 ms 4 ms 10.33.75.2 4 9 ms 4 ms 4 ms 10.33.2.13 5 9 ms 5 ms * 10.18.1.3 6 * * * Timeout 7 10 ms 6 ms 6 ms 90.243.243.21 //first public address

For all, who don't know what to make of this: Hop 1 is the first private network. Hop 2 is *another* private network which contains our network. And hop 3 is *yet another* private network containing the second network. A Matryoshka doll of networks, if you will. And *then*, just to top it off, the packets also get bounced around on *at least* two different servers (hops 4 and 5, possibly 6) inside this network before they finally get to see the actual internet.

Granted, this may not be the actual source of the problem. But it sure ain't helpin'.

Have those guys never heard of stuff like VLAN?

Those are the same guys, by the way, which disabled the WLAN for a while because there was some old Windows XP box infected with Conficker on the loose. I actually had to tell them about stuff like snort and nmap which makes finding such hosts absolutely easy.

tl;dr: Yo dawg, we heard you like NATs so we put a NAT in your NAT'ed NAT so you can NAT while you're NAT'ing the NAT.