Zapret Unable to Process Client Packets Due to Missing Hostname!

[hamedsbt]

Hi, I am encountering an issue with zapret in my network setup and would appreciate any help or suggestions.

Network Topology:

• Client IP: 192.168.0.3
• Client's Gateway (is openwrt and acting as Zapret and DNS server): 192.168.0.2
• Modem (is openwrt and acting as Gateway of Client's Gateway): 192.168.0.1
• Internet

Issue:

• Zapret, running on the client's gateway (192.168.0.2), can receive its own packets and the client's packets. However, it is unable to process the client's packets because it cannot find the hostname.

Zapret Log:

IP4: 192.168.0.3 => 48.210.78.165 proto=tcp ttl=63 sport=34706 dport=443 flags=S seq=1188708084 ack_seq=0
desync profile search for tcp target=48.210.78.165:443 l7proto=unknown hostname=''
desync profile 0 matches
packet: id=2377 pass unmodified

Are there any specific configurations or settings in zapret that need to be adjusted to ensure it can resolve hostnames from client requests?

Any insights or suggestions would be greatly appreciated. Thank you in advance for your help!

[bol-van]

Your conclusion about hostname is completely wrong.
Hostname is extracted from data payload (TLS hello, for example).
In your log only SYN packet is present.
Routing inside single subnet is tricky, it will not work out of the box
Disable icmp redirects and enable masquerade on 192.168.0.2

[hamedsbt]

Thank you for your help. The issue was fixed by enabling 'Masquerading' on LAN. I tried to find out how Masquerading affects the 'table inet zapret' by investigating it, reading documentation, and watching YouTube videos, but I couldn't understand how 'Masquerading' helped zapret to extract the 'Hostname' correctly. As far as I know, Masquerading just replaces the source (client) IP 192.168.0.3 with its gateway IP 192.168.0.2, which are in the same subnet. Could you help me understand this, please? Thank you!

[bol-van]

On the single subnet without masquerading reverse traffic will go directly to client bypassing zapret gateway.
This break connbytes filter used in ip/nf tables and disables some bypass methods
Masquerade ensures reverse traffic will be destined to zapret gateway