digitalsidhe

I found another way to check on whether my router is rewriting source IP addresses when doing port forwarding: see what the Received: headers in my emails say.

Up until about a week ago, they said things like this. Here's one from a message I got from a Gmail address:

Received: from mail-pa0-f46.google.com (mail-pa0-f46.google.com [209.85.220.46])
	(using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
	(No client certificate requested)
	by finrod.silmemar.org (Postfix) with ESMTPS id C935421C4386
	for <silmemar@silmemar.org>; Sat, 13 Sep 2014 12:04:43 -0700 (PDT)

And here's one from Livejournal:

Received: from livejournal.com (mail.livejournal.com [208.93.0.48])
	by finrod.silmemar.org (Postfix) with ESMTP id 0040A21C49E0
	for <digitalsidhe@silmemar.org>; Fri, 12 Sep 2014 23:44:32 -0700 (PDT)

In both cases, the stuff in the blue is the IP address that connected to Finrod, and the stuff in pink is the result of a hostname lookup on that IP address. (The stuff before that, after the word "from", is what the remote machine claimed as its hostname or domain.)

Then, starting on Saturday the 13th (when I switched to the new TP-Link router), they start looking like this:

Received: from mail-pa0-f47.google.com (unknown [162.245.22.24])
	(using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
	(No client certificate requested)
	by finrod.silmemar.org (Postfix) with ESMTPS id C2FF821C3E80
	for <silmemar@silmemar.org>; Thu, 18 Sep 2014 14:51:53 -0700 (PDT)

Received: from livejournal.com (unknown [162.245.22.24])
	by finrod.silmemar.org (Postfix) with ESMTP id 7445921C3D1C
	for <digitalsidhe@silmemar.org>; Thu, 18 Sep 2014 17:51:31 -0700 (PDT)

In both of these cases, 162.245.22.24 is my own IP address — or rather, the external (WAN) address of the router. The "unknown" result comes because this is a dynamic, residential IP address, and has no hostname associated with it.

This goddamn, piece-of-shit, TP-Link router is forwarding the connection, but not rewriting the source address, so any kind of tracking, spam likelihood analysis, or traceability goes right out the window.

Fuck this shit. I am so pissed right now.

Why would anyone even sell a piece of crap like that? And why did I throw away the packaging and receipt already?