Among them was the challenge called InZiPtion.

The initial challenge post was straightforward. We were provided with a zip file and upon opening it, we had a zip with nested zip files. I have seen such tactics many times in the CTF. Though I am not an avid CTF player and this one is probably my 3rd time playing, I always tend to read write-ups of the challenges when someone posts them on social media.

Along with the zip file, was a hint rar file where within it lay a text file that said as shown in the screenshot below.

Our first move was to automate the process of unnesting the nested zips using a simple bash script.

while [ "`find . -type f -name '*.zip' | wc -l`" -gt 0 ]; do find -type f -name "*.zip" -exec unzip -- '{}' \; -exec rm -- '{}' \;; done

Now once we extracted every zip within the zip. We had a list of empty text files each with name chunky_numeric values.

Now we had that many text files we couldn’t just go and start opening every one of them manually. As all of them were empty, and our guess was one of the text files must have something. So we decided to automate this process using bash script. First, we open all txt files and only show the ones that have strings in it.

#!/bin/bash

# Loop through all .txt files
for file in *.txt; do
    # Check if the file is not empty or only whitespace
    if [ -s "$file" ] && [ "$(tr -d '[:space:]' < "$file")" ]; then
        echo "Contents of $file:"
        cat "$file"
        echo ""
    fi
done

Using this, we found that the text file named chunky_69.text had something in it as shown below.

It’s a base64 encoded, upon decoding it we found this ISTHISACIPHERKEY

There was also a single rar file which was password protected. So as written in the starting hint text file, we have the encrypted rar file. But what now? We had no other clues and the only way to get that encrypted rar file opened was either using the password or just by brute-forcing. So my other teammate, Rabindra Man Bajracharya started brute-forcing it using John Ripper with the latest rockyou file.

While my other teammate was brute-forcing the rar file, I started looking for the clues. After moving around and going through the files multiple times, I discovered something strange. First of all, from the beginning, I was interested to know why they named the text files chunky each with ascending numeric values. I started reasoning that it must be on purpose and there must be something about it. In computer science terminology, chunky as in chunks can mean many things.

Another thing that I found interesting was each text file had a different number of newlines. So it was not empty after all, just empty new line spaces. The first chunky_0.txt had 52 new line spaces.

Also at the same time I was playing around with the encrypted rar file. I tried looking into it by opening it in a hex viewer thinking I might find something interesting, maybe a header info hidden in the rar.

Then it somehow clicked. The hex values I saw on the viewer and the number of new lines of each text file started looking like chunks of data. Our initial thought was to get the new line space count of all text files, convert those numeric values in hex, and make a rar file out of it. But it didn’t work out, so we tried converting the hex value into ASCII thinking there might be something interesting.

First, we used automation to get the new line counts of all the text files and store them on a text file in an ascending order following the numeric naming of the texts.

#!/bin/bash

# Output file
output_file="line_counts.txt"

# Clear the output file if it exists
> "$output_file"

# Loop through files, sort by numeric part of the filename
for file in $(ls chunky_*.txt | sort -t'_' -k2,2n); do
    # Check if the file exists and is readable
    if [[ -f "$file" ]]; then
        # Count the number of lines in the file
        line_count=$(wc -l < "$file")
        # Output the file name and line count to the output file
        echo "$line_count" >> "$output_file"
    fi
done

echo "Line counts written to $output_file"

Then we converted each word count into hexadecimal values by automating it using bash script.

#!/bin/bash

# Input file with decimal line counts
input_file="line_counts.txt"

# Output file with hexadecimal line counts
output_file="line_counts_hex.txt"

# Clear the output file if it exists
> "$output_file"

# Read each line from the input file
while IFS= read -r line; do
    # Extract the filename and line count (assuming format: "filename: count")
    filename=$(echo "$line" | cut -d':' -f1)
    line_count=$(echo "$line" | cut -d':' -f2 | xargs)  # Remove any leading/trailing spaces

    # Convert the line count to hexadecimal
    hex_count=$(printf "%X\n" "$line_count")

    # Write the filename and hexadecimal line count to the output file
    echo "$hex_count" >> "$output_file"
done < "$input_file"

echo "Hexadecimal conversion complete. Output written to $output_file"

Now we had the hex values and the only thing left for us was to convert it into ASCII.

And there it was, our another clue to the flag.
4r3_y0u_h4v1ng_fun_1_sur3_4m_h4v1ng_fun_g00d_luck_4_supr1s3_m1ght_b3_1n_1ts_w4y_y4_It5_l0ng_P4a55_D0nT_H4t3_m3

So, our first thought was it must be the password for the encrypted rar and we were correct. Upon unlocking the encrypted rar file we got a new text file that had what seemed like a flag and it also seemed like it was encrypted in some way. So, we immediately remembered the base64 cipher key we found on the chunky_69 text file.

Now only thing left was to figure out what cipher was used to encrypt this. Surprisingly, with a simple prompt by giving the Cipher Key and the Cipher text in the ChatGPT, we were able to find out about the cipher name. It was Vigenère cipher.

And there we have it. The flag was nca{unz1pp3d_but_st1ll_scr4mbl3d} .

A big thanks to the NCA Team for creating such fun challenges.

Now that we know what kind of restriction it is and how it works. In this blog, I will try to apply the same method to Android apps that come with split APKs.

The split apks method has started getting more common these days, as it solves a lot of problems related to the spec differences of a vast number of Android devices. It also helps devs to quickly push short updates for specific components of the app.

I will be using MeMuPlay Android Emulator on my Windows 11 machine to test this apk having split apks.

Once the app is installed. Connect to the Emulator's adb from your Windows Terminal. Enter into the shell of the emulator using adb shell the command. You can use this command to search for the package you looking for.

In my case it's io.github.ictsolved.csit

Now find its path. Using the command as shown below

Now grab all the APKs from the emulator. To do that, make sure you copy the folder location of the package and use adb pull to copy it into your PC.

Go inside the directory. You should have files that look like this.

Those 3 apk files are what we are interested in. Since I am using an emulator, let's look at the split_config.x86_64.apk file.

So this one has the libflutter.so file. We use reFlutter on it to add our bypass.

Once you reflutter on the right apk, sign all of the apks using uber apk signer.

Uninstall the app from the emulator and use adb to install the apks. To install multiple apks, use this command

adb install-multiple
Make sure you add the base.apk first, then enter split apks behind it. And don't forget to add the signed apks only, you won't be able to install non-signed apks or it won't work.

And that's it. Start your analysis using Burp Suite. You can also download split apks from the sites like Apkmirror. They usually pack those apks inside an XAPK zip-like format. You can simply extract it grab the apks from it and follow the procedure.

However, I have discovered other use cases for this. Like I can directly expose a service with the same ports from the same machine. With the help of Macvlan, every container will have its own virtual LAN port, meaning it will have its own MAC Address and will act as a LAN port directly connected to my primary router.

To do this first you have to know your IPV6 Prefix and IPV4 subnet of the network.

In my case, let's assume that I have ipv6 prefix 2400:1a00:XXXX:XXXXX::/64

First, go to your server's terminal and create a network with the Macvlan driver in your Docker. To do this enter the command below

docker network create -d macvlan --subnet 192.168.1.0/24 \
 --gateway 192.168.1.1 \
--subnet 2400:XXXX:XXXX:XXXXX::/64 \
 --gateway 2400:XXXX:XXXX:XXXX::1 \
 --ipv6 -o parent=eth0 dualmac -o macvlan_mode=bridge

Make the changes on the subnet and gateway of both IPv4 and IPv6 according to your own Network setup. You can also set it for IPv6 only if you like.

On the parent= , you have to enter the name of the main network interface. And right after that line, you can see that I have written dualmac. You can write whatever you like, it's the network's name so name it as per your preference.

Once that's done, you have created a network with Macvlan, now you can assign it your container.

First, check the network if it has been correctly configured or not. You can do that by entering docker network inspect <Your Network Name>. In my case it's dualmac.

Observe the Subnet and Gateway and make sure they are correct.

Now assign your container to the network using Docker Compose. In your docker-compose config file add these to assign it to the network you have created.

You can let the docker container dynamically get the IPs, but it often ends up with getting IPs that have been used already, so it's better that you assign them manually from your docker-compose config file.

        networks:
            ipv6net:
            ipv6_address: 2400:XXXXX:XXXXX:XXXXX::4
            ipv4_address: 192.168.1.4

networks:
  ipv6net:
     name: dualmac
     external: true

Place them as shown in the screenshot below. You can name the networks on the config as you like, in my case, I have named it ipv6net . And in the name: dualmac , enter the name of the docker network you created previously. And that's all. Now start your container using the config file, and you should see the container getting IPs directly from your primary router.

In the screenshot below, you can see the torrent client directly communicating with the IPv6 peers.

If you do docker network inspect on your newly created network, while running the containers using it, you can also see the IPs and MAC being used for the container.

Note:
If you only want your docker container to get the public IPv6 and nothing else, then you can simply set the network mode to host. With that, you won’t have to depend on macvlan or the hefty, troublesome docker network configurations. The container will act as a network host device and will request your network's DHCP server for IP assignment. And of course, your container will get IPv6. But make sure you have IPv6 enabled in the main docker configuration.

Finding the right service provider to fix this issue is really troublesome. Before I was introduced to the Cloudflare Tunnel, I was using Ngrok to expose some of my Nginx web services to the internet. However, it had a lot of limitations, especially for free users. Like, using your own domain name required a premium plan, also the speed and the latency were really troublesome. The randomly generated domain it provides also is not good as they are known for being used in Phishing Attacks.

And then I came across Cloudflare Tunnel. I already had gotten my free domain name from register.com.np and had already set it up to work with Cloudflare. This will help a lot if you are planning on using the Cloudflare tunnel.

Now setting up Cloudflare tunnel is fairly simple. You open up a terminal of your server and enter

apt install cloudflared

Once it's installed, you simply log into your Cloudflare account using the command

cloudflared login

You should be redirected to the web browser. Once you log in, select the domain name that you want to use. Head back again to the terminal and enter the command

cloudflared tunnel create <NAME>

in the <NAME> place, enter the name that you want

You can try entering cloudflared tunnel list command to check if it's been created or not. Also, make sure you note down the location of the credentials file that's on JSON and the ID, which is basically the JSON file name.

Now you have created the tunnel, create a config file so that it will be easier to add services that you want to expose to the internet via Cloudflare Tunnel.

One of the great features of Cloudflare Tunnel is that it lets you use your own domain name while exposing services to the internet.

I will try exposing a simple file-serving web server that is made using Nginx which is on port 1337

Create a config YAML file like this

In the tunnel, enter the ID of the tunnel you got while creating it, and in the credentials file enter your JSON file location that you got while creating the tunnel.

tunnel: <Tunnel-UUID>
credentials-file: /root/.cloudflared/<Tunnel-UUID>.json

ingress:
 - hostname: test.bimal1412.com.np
   service: http://192.168.1.170:1337
 - service: http_status:404

For example, in the config above, add the subdomain name where you want your service to be accessible, and in the service, add your service's address. You can add add many services as you want. Just add another - hostname and below the service address you want to expose.

Once it's done, save the config file. Goto your Cloudflare Web Dashboard, and add a CNAME record with a name you are using on your config, for me it's test

and in the target box, add <YOUR TUNNEL ID>.cfargotunnel.com

And hit save. You have to do it with multiple subdomains if you are trying to expose multiple services to the internet.

Now on the server run

cloudflared tunnel --config /path/your-config-file.yaml run

it should start exposing your service to the tunnel and should be accessible through the subdomain name.

Now to run the whole thing in the background as a service, Cloudflare makes it really easy. Before running it as a service, first move the config.yml file you created to the Cloudflared's directory, which in my case is /root/.cloudflared/, and also make sure the config file is named config.yml.

Now that's done. Just run the command

cloudflared service install
systemctl start cloudflared

And that's all. Now the tunnel service should be running in the background and will auto-restart itself if the internet goes out or the server restarts.

To check if it's running or not just enter service cloudflared status

If it's saying active in green, then you are good to go. And the best part is, speed is really good.

It totally depends on your home's Internet upload speed since you are sending the file to the tunnel and again receiving it from the tunnel.

You can also tunnel the ssh of your machine to the internet.

In the config service file simply add

- hostname : <YOUR DOMAIN NAME>
  service: ssh://<YOUR MACHINE IP>:22

But the tricky part here is, that to access the SSH, you need to have Cloudflared installed on the machine and have to make some edits to the config. You can download and install Cloudflared for Windows 11 using Winget or you can just head over to this link and download it from there.

For example, on my Windows 11 machine, inside the .ssh directory, I have made a config file like this

Inside the config file

Host <YOUR SSH SUBDOMAIN>.bimal1412.com.np
     User root
     ProxyCommand cloudflared access ssh --hostname %h

Make sure that you installed Cloudflared and added it to the system environment properly.

Once that's done you can access the ssh of your machine from the internet.

There is also a service of Cloudflare called Zero Trust, that lets you access the SSH terminal directly on the browser, but to access it's free plan you need to have a working Credit Card. I somehow managed to add a working card and use it to access the ssh from the browser.

Also, it can add an extra layer of authentication to all of your tunnels.

For example, here it lets you add your tunnel services to a dashboard like this. And while accessing each of those services, you can set up different kinds of verification with your own custom pages.

The usual build of OpenWRT already comes with a lightweight HTTP web server called uhttpd. It was designed for embedded systems with very low system resources, which explains its overall size and the operating system demand.

To access your web app that uses bash CGI, let's create a service on a different port. This will ease the process while exposing it to the internet if you are planning on tunneling it or proxying through other services.

To create a separate service for a port. You have to edit the uhttpd config file. To do that, ssh into your OpenWRT machine. And edit the config file located in /etc/config/uhttpd .

In the screenshot above, you can see that I have created a config with a name other . Inside it, I am exposing the webserver to port 8080, since port 80 is already being used by the LuCi.

config uhttpd 'other'
        list listen_http '0.0.0.0:8080'
        list listen_http '[::]:8080'
        option home        '/www/users/'
        option index_page  'test.cgi'
        option cgi_prefix '/'
        option rfc1918_filter '1'
        option max_requests '3'
        option max_connections '100'
        option cert '/etc/uhttpd.crt'
        option key '/etc/uhttpd.key'
        option script_timeout '60'
        option network_timeout '30'
        option http_keepalive '20'
        option realm 'users'
        option tcp_keepalive '1'

In the option home, put in the directory where you are planning to store your web applications files. In the option index_page, add the index page file name that you want to show while visiting the web server. For example, I have put a test.cgi as a filename, which I have it in the location.

Once you modify the config based on your needs, save it and restart the uhttpd service. You can do that by entering service uhttpd restart on the terminal.

Now you can go to the port 8080, and you should see the server working. Since we haven't added the files on the location, it might show an empty index page.

Now to create the web app using the bash CGI is not that hard. If you know bash scripts then you should be able to pick it up in no time. For those who are not familiar with it, I suggest that you read this awesome documentation.

You can see here that I have made a simple web app using bash CGI to control the internet access to the users I am sharing my home internet with. Since it's bash, you can execute shell commands directly from the web page.

Here's a small sneak peek into the code. I am using Bootstrap for the table and the buttons. The information like days remaining and expiry dates are generated dynamically on the web page by executing the shell commands.

For example, if you want to show the uptime of the system on your webpage you can do

#!/bin/bash

echo "<h3>$(uptime)"

You basically, echo out the language that your web program understands, i.e. HTML, CSS, and JS.

And that's how you start writing your own bash CGI application and deploy it into your OpenWRT. This is a basic way of controlling your OpenWRT from the web. Check out the official documentation on the uhttpd from the OpenWRT. There are many advanced things you can do with it like adding basic HTTP authentication, using php, and so on.

The setup box they are using for their IPTV packs average specs, with only 1 GB of RAM, an Amlogic S905X Processor, and a mere 8 GB of Internal Storage. It's running Android OS with a very restrictive launcher kept on the home screen. This means you won't be able to use developer tools settings or adb on it.

The problem here is you won't be able to sideload any apps on it. You are stuck with the apps that the company chooses to provide. There have been many attempts and bypasses to sideload the apps. But they were patched in the latest firmware update.

Previously there was a feature introduced on the NETTV box that let users remote control it through the network. But some users found a way to use that to send some other remote navigation packets to the box, making it open Android's Native System Settings. With that opened, users could enable the developer option and with adb enabled basically have shell access. Also, the box comes pre-rooted.

This method stopped working soon after NETTV noticed it and they removed the Remote feature from the Box.

Another method surfaced which involved using IR Blaster phones to send the right keymap to open the Native Setting again on the box. But that was also patched by on the firmware version 020809. If you have firmware version 020F07 or less, you can try this method to bypass the restriction in a much easier way.

Now talking about the UART Interface method. You need to have a UART to USB converter dongle first. You can buy it from Daraz. I used this one and it worked flawlessly.

If you don't know what is UART and how it works you can watch this video.

Now once you know how it works. Open your NETTV setup box. Look for that UART Pin out and connect it to the right pin.

Since I have done it myself and figured out which PIN is for what, I have this image labeled below that will help you.

Once you connect the right PIN, power on the box while connecting it to the converter that is connected to the PC, and use the right bit rate for the communication. I think used 115200, but I might be wrong. If it starts throwing gibberish try 9600.

I used Putty on Windows for the serial connection. You can use whatever tool you like. Once you get everything right you should get a booting info throw in the screen that is similar to Linux. Once it completes booting, you have the shell access. It's that easy.

You can go full root using su and start modifying things you would like to change. The first thing I did was install a different launcher and that's all. Since it's an adb shell, you can directly install apps using adb commands.

And that's all. With a different launcher, you can install other 3rd party apps. For me, installing SmartTubeNext was a big deal, as this app has tons of features including Sponsorblock and Adblocks.

In the case of Worldlink, it's the same. But the thing with Wordlink's CPEs is they haven't enabled any sort of firewall. This means all of the inbound and outbound traffic for the IPv6 is allowed. That means the devices have to protect themselves with their built-in firewalls. I am guessing they are doing this because they don't allow router access to the customers and users who want to add firewall rules for their IPv6 would have to contact them, which I am sure will be troublesome. So, they thought of letting it all in without thinking about the security consequences.

Too much restriction was also not my liking so I thought about getting a secondary router. I had a fair share of experience using and installing OpenWRT as previously I did a lot of experiments installing it on TP Link routers. But it was 2023, so I had to look in the market for some better routers with good support for the OpenWRT.

During my search, only one router popped up everywhere. It was Xiaomi's Mi Router 4A Gigabit. It had a decent processor, RAM was 128 MB and Flash Memory was 16 MB. What caught my eye was the RAM, that's really good.

So I bought one. Installed OpenWRT on it using this method, and got it running within a few minutes.

Now setting up the IPv6 was really a tricky part. Since my ISP provides a dual-stack IP, meaning I get IPv4 and IPv6 together. But the thing is, IPv4 is NAT and has no problem with me again putting it behind another network. But for IPv6 to work in such a way that every user connected to the Mi Router gets a public IPv6, the interface for IPv6 has to be set in a relay mode. Also, one of the reasons we are forced to use this relay mode or NDP proxy mode is because most ISPs in Nepal are assigning /64 address block to the CPE, meaning you can’t further prefix delegate the IPV6 to a larger pool. Though this current method does help with the IPV6 assignment via secondary router, without the prefix delegation, it is impossible to properly manage or create separate VLANs and networks.

To set the interface to the relay mode. Just go to the network interfaces.

Edit your IPv6 WAN Interface and turn off the DHCP there. And make sure to change the IPv6 settings there as shown in the image below.

With that done, save it. And now head over to the LAN Interface. Edit the interface and go to it's DCHP Server Option and there make changes to the IPv6 settings as shown in the image below. You can skip the IPv6 DNS Server and leave it as it is.

Now with that done. Save the changes and reboot your router. And you should start seeing your devices getting IPv6 assigned directly from the main CPE.

Now that's done. While exposing a port, you need to first allow that port from the firewall settings on your router. You can do that by heading over to the Firewall settings under the Network tab.

As you can see here, I have allowed the UDP protocol with ports 1195 and 1194. Those are for the VPN Server that I am hosting on my Linux servers. With that done those ports will be accessible by other IPv6 users.

Update 2025:
After the recent social media bans here in Nepal, many of us were forced to use DoH DNS services to bypass the blocks. And the best way to do that was to configure your router to do it. Normally, OpenWRT and most of the routers don’t come with DoH support; they only provide a plain IP input field to be sent to the DHCP devices. To fix this, you can self host a recursive DNS server and use tools like DNSCrypt to make those DNS queries go through secure DoH of popular DNS service providers like Cloudflare or Google. OpenWRT also provides packages that can forward your plain DNS requests to the DoH, which saves you the trouble of setting up the PiHole + DNSCrypt.

But the main issue is, when you are relaying the IPv6 to the devices, the router also automatically gives the default IPV6 based DNS servers that come with the ISPs. And it becomes really tedious to bypass.

Fortunately, you can change your IPV6 DHCP settings as shown below in the image to announce your own custom IPV6 DNS server even if it’s running in a relay mode. In the DHCPv6-Service set it to server mode and in theannounce IPV6 DNS servers, you will have to add your PiHole NAT6 local IPv6 address, or you could just input your OpenWRT’s default local IPV6 gateway there. Entering your OpenWRT’s default local IPV6 address will just forward it to whatever DNS server you have configured in your WRT’s router settings. Do note that this is a LAN interface we are configuring, not WAN6.

With that done, the devices will get two DNS assigned, IPV4 & IPV6 that you have set, thus bypassing the blocks.

You can see devices getting assigned the IPV6 DNS server you set in the Annouced IPV6 DNS Servers option.

I have PiHole + Dnscrypt setup, so it’s much easier to monitor and block domains that you don’t want. Though ISPs still can check your DNS Queries even if you use DoH or DoT. Using complex SSL inspection, they can check every packet’s SNI and implement a block based on that. So, using DNS over HTTPS is not a magical hack to bypass everything, but some ISPs do lack such hardware and software expertise, so if you are not a Worldlink user, then you are good to go.

That's an insane cost. With that much money, you can get a decent 2nd hand Desktop CPU and use it as a home server, which will be more powerful and modular than these Raspberry Pis.

So what's the alternative to this?

Android TV Boxes are where they start shining here. In the past years, Android TV Boxes have started becoming really powerful with their chip makers upgrading their CPU for more demanding tasks like 4K video decodings and resource-heavy games.

What's more surprising here is their cost. An Android TV Box with 4GB of RAM and Almogic S905X3 costs around 6-7K, which is really good. Amlogic S905X3 comes on par with the CPU that comes inside the Rasp Pi 4 models. I would say that these are even faster. You can see the benchmarks here. Also not to forget about the extra accessories costs. With a 6-7K cost, an Android TV Box comes packaged with everything it needs to get it to start running. The box's board already has a big heat sink on the CPU, has EMMC storage, has a nicely done air-vented casing, and comes with a power supply cable.

The only thing it would be lacking compared to the Raspberry Pis is the GPIO PINs, which are not needed if you are only going to use it as a home lab Linux server machine.

You can head over to debian-on-amlogic, download a Linux image file that is compatible with your TV Box, and install it.

Remember this, we are installing Linux directly on the EMMC of the Android TV Box. It's not running in an emulation over Android. Meaning, that Linux will boot once you install it on the box.

Currently while writing this, there are 2 TV Boxes available in Nepal that support this Linux installation.

• X96 AIR 4 GB RAM 64 GB Internal Storage ( cost 6.7 K )

• X96 Mini 2 GB RAM 16 GB Internal Storage ( cost 3.8 K )

I own HK1 Box and H96 Max X3, both have Amlogic S095X3 processors and using them as a home server for many years. Though they are not available in the Nepali market right now.

Linux installation on them is fairly easy. You download the right image and flash it on a USB Thumb Drive using Balena Etcher, connect it to your TV Box, and press the reset button while powering it on. And that should make it boot from the USB. From there, follow the instructions and you are done. Once the installation is complete just disconnect the USB and you are good to go.

I keep mine on a stairs side walls using a wall mount rack. The good thing is, this HK1 TV Box has a Gigabit Ethernet. Meaning the data transfer rate can go up to 100 MB/s. I have connected a 2 TB external hard drive into the Box there. Did some configuration on the Linux system to make it auto-mount using fstab.

There is also an SD card slot in the box. Since I had a spare 32 Gigs SD card lying around. I put it inside the box and also kept it on the automount config in the fstab.

With that auto mounting, I have been using Samba to access the files from the network.

It's been really easy to use it as a media server. I am using Kodi on devices and these TV Boxes feed the data to it.

With that said these TV Boxes are incredibly powerful and power efficient. I have been also using it to run some docker containers to host Django applications and the Nginx server. They run with no problem.

Talking about the performance. I once had a Raspberry Pi 3B, given to me by an internet friend. And it was really slow.

Also, I got only a bare board from him. Meaning I had to buy the power supply, memory card, a case, and a heat sink.

Buying all of those cost me around 2K. This Raspberry Pi 3B model had 1 GB RAM and it's CPU was clocked around 1.2 GHz. The performance lag could be instantly felt while using the terminal.

So, after a few months, I decided to use a heat sink on it. But while trying to adjust the heat sink I accidentally knocked off a few of the resistors and capacitors off the board, causing WiFi, LAN, and some USB ports to not work.

Since I was using it for some critical home use, a small Linux machine was needed. I decided to get the TX3 Mini Android TV Box to fill that needed hole asap.

Finding the reset button on this box was a little confusing since all of the TV Boxes used to have their reset button inside the audio port. For some reason, this box had it on the center of the opposite side of the box. Once I installed the Linux on it. The performance was noticeable compared to the Raspberry Pi 3B, even though both of them have CPU clocked at 1.2 GHz.

So, you can see from this experience how easy and hassle-free it is to do this on a TV Boxes compared to the Raspberry Pi. It saves you from the trouble of buying all of those extra accessories.

I have been also using it as an OpenVPN server which I have written on my previous blogspot.

One of the good things about Worldlink is that they have made it possible for their customers to communicate with each other inside their NAT network. Every CPE of the Worldlink users get a dynamic NAT IP and all of them can talk to each other. There seems to be no firewall restriction on the CPE or on their branch switches. So if you open a port on one of your devices connected to the CPE, you could ask the ISP to port forward it to their NAT IP.

For example, here currently I have a NAT IP 100.118.32.150 on my CPE right now. I have router access which was really troublesome to get but I managed to do it somehow. Maybe I will write a blog about it.

You could also get this NAT IP address from your myWorldlink App. It should be on the router details tab. Anyway, once you know the NAT IP. Contact your ISP and tell them to forward a port from the device IP you are exposing to the NAT IP. Here I have exposed a port 8000 using Python's HTTP server.

Once they forward the port. You can simply access that service through the port that your ISP has forwarded to the NAT IP.

You can share your NAT IP with the port to other Worldlink users and they will be able to access it. And the best part of this is the latency is crazy good. Since it's on the same NAT network, you will get around 8-10 ms latency. However, the bandwidth will still be limited to the internet package speed you have subscribed to.

Now we know the basic working process of the port forwarding on the NAT network of the Worldlink. Let's talk about how we are going to use it to play multiplayer games that support Local server or LAN gameplay.

To achieve this you will have to set up a VPN server and forward the server's port to the NAT IP. Once the port is forwarded, other Worldlink users will be able to connect to the VPN and communicate directly with other users connected to the server. This will save some firewall and port forwarding troubles for different games and applications.

In my case, I have a Linux machine that runs 24/7. It's a low-powered TV Box that I have installed Linux on.

For the VPN Server, I am using PiVPN. It's really easy to set up and lets you choose between Wirguard and OpenVPN. I recommend you choose OpenVPN as it supports the TAP interface which is really important for LAN multiplayer games.

Once you installed it. There are a few things you need to change to make it workable.

First, edit the OpenVPN server config file which you can find in /etc/openvpn/server.conf . Change as shown in the image below

dev tun to dev tap
proto udp to port udp6

Changing udp to udp6 is something that will make it possible to connect with other ISP users with IPv6. The thing is many of the big ISPs here in Nepal have started deploying IPv6 to their customers, including Worldlink also.

Since IPv6 doesn't have NAT, every device gets its own unique public IPv6 address which can be used to communicate with other IPV6 devices on the internet. It's so easy to expose a port to the internet using IPv6. There is no need for port forwarding, you just expose a port and it's online on the internet. In Worldlink's case, they have not implemented any kind of firewall on their CPE. The only thing that stops or protects your devices with IPv6 addresses from being exposed to the internet is a firewall, which for some reason worldlink has decided to disable on their CPE. Meaning you will have to depend on your own device's firewall.

Currently, while I am writing this, as far as I know, ISPs that have IPv6 fully deployed are Worldlink Communications, Vianet, Classictech, and Dishhome.

But since IPv6 solves everything, why not use it for the connection instead of NAT? For some reason, while using IPv6 the latency goes around 80-90 ms. Looking at the tracert , it's clear that the request goes outside the country making it 80-90 ms. Maybe it can be fixed with some routing config from the ISP side, I don't know.

The above IPv6 address is from a Vianet user and I get around 70-80 ms latency while doing a ping.

So, using the NAT IP to connect to the VPN server has its benefits but it is limited to the Worldlink users only. The good thing is that the VPN server can be connected using both IP versions, i.e. IPv4 and IPv6.

Leave the proto to udp6 in the server config.

Now we have explained the IPv6 part let's get to the setup process again.

Once you saved the config. Make sure you remember the port you set for the OpenVPN, the default is 1194. Because that is the port you want to forward for the NAT IP. Since I have router access, this is what it looks like when a port is forwarded inside the router. Ask your ISP to do it for you, they have access to your router.

Now on your server machine's terminal. Use the command pivpn -a to add a user. Once you add a user, it generates a config file. Get that config file and make some changes based on your connection.
dev tap
proto udp
remote YOUR_SERVER_IP 1194
route-nopull

Set the dev tun to dev tap

Set the proto to udp6 here only if you are trying to connect to the VPN server using IPV6 address, if you are trying to use NAT IP or IPv4 then leave it as udp

And make sure you add route-nopull . It stops routing of the server network to the users and fixes some IP conflicts as well.

It should look something like this in the image below. I am using a domain name instead of IP. You can do that as well by setting up a DDNS using scripts and automation.

Once the config file is modified. Download the OpenVPN Client program and import the config then connect.

On the server terminal, you can use pivpn -c to view the connected users. Generate the config file for each user.

Now start playing your favourite offline LAN multiplayer games with your friends.
Some of the games I play with my friends are :

• Far Cry 2

• CS Warzone

• Torchlight 2

• Left 4 Dead 1/2

• Need For Speed MW

• Line of Sight Vietnam

• Halo

• Minecraft

• etc

Also, make sure to set your OpenVPN's TAP Network Interface metric to a lower value. E.g 10. The lower the value, the more priority the interface will get. Some games without direct IP connection automatically use the interface with higher priority.

Similarly, you can play games that support offline LAN multiplayer on Android as well. The tricky part on Android devices is getting the TAP interface to work. Fortunately, there is a VPN app called VPN Client Pro, which supports .ovpn config files and makes the process much easier. Just install the app, import the config, and connect. It's that easy. I tested this with BombSquad and Mini Militia. Worked great.