Block or drop DNS requests within forwarded packets
I have a default Debian 9 installed in minipc, which is forwarding packets further.
I wish to be able to block hosts via domains, means if any forwarded packet of DNS type has request for example of youtube.com, it should be dropped.
I know there are methods to drop them within iptables rules, but it is not advised technique.
I am afraid that setting dnsmasq or bind wont work, since few computers has google's 8.8.8.8 DNS server hardcoded (Few IoT devices).
So is there a way to either:
- force DNS resolving via my dnsmasq/bind (so i can setup a blacklist)
- drop DNS request packets containing 'youtube.com' without iptables
Any ideas?
debian networking iptables dns
edited Jan 12 at 1:22
Rui F Ribeiro
39.5k1479133
asked Jan 9 at 21:34
RedSRedS
204
add a comment |
I have a default Debian 9 installed in minipc, which is forwarding packets further.
I wish to be able to block hosts via domains, means if any forwarded packet of DNS type has request for example of youtube.com, it should be dropped.
I know there are methods to drop them within iptables rules, but it is not advised technique.
I am afraid that setting dnsmasq or bind wont work, since few computers has google's 8.8.8.8 DNS server hardcoded (Few IoT devices).
So is there a way to either:
- force DNS resolving via my dnsmasq/bind (so i can setup a blacklist)
- drop DNS request packets containing 'youtube.com' without iptables
Any ideas?
debian networking iptables dns
edited Jan 12 at 1:22
Rui F Ribeiro
39.5k1479133
asked Jan 9 at 21:34
RedSRedS
204
dnsdist is another option. check manual dnsdist.org/rules-actions.html
– ibrahim
Jan 11 at 7:52
add a comment |
I have a default Debian 9 installed in minipc, which is forwarding packets further.
I wish to be able to block hosts via domains, means if any forwarded packet of DNS type has request for example of youtube.com, it should be dropped.
I know there are methods to drop them within iptables rules, but it is not advised technique.
I am afraid that setting dnsmasq or bind wont work, since few computers has google's 8.8.8.8 DNS server hardcoded (Few IoT devices).
So is there a way to either:
- force DNS resolving via my dnsmasq/bind (so i can setup a blacklist)
- drop DNS request packets containing 'youtube.com' without iptables
Any ideas?
debian networking iptables dns
edited Jan 12 at 1:22
Rui F Ribeiro
39.5k1479133
asked Jan 9 at 21:34
RedSRedS
204
I have a default Debian 9 installed in minipc, which is forwarding packets further.
I wish to be able to block hosts via domains, means if any forwarded packet of DNS type has request for example of youtube.com, it should be dropped.
I know there are methods to drop them within iptables rules, but it is not advised technique.
I am afraid that setting dnsmasq or bind wont work, since few computers has google's 8.8.8.8 DNS server hardcoded (Few IoT devices).
So is there a way to either:
- force DNS resolving via my dnsmasq/bind (so i can setup a blacklist)
- drop DNS request packets containing 'youtube.com' without iptables
Any ideas?
debian networking iptables dns
debian networking iptables dns
edited Jan 12 at 1:22
Rui F Ribeiro
39.5k1479133
asked Jan 9 at 21:34
RedSRedS
204
edited Jan 12 at 1:22
Rui F Ribeiro
39.5k1479133
asked Jan 9 at 21:34
RedSRedS
204
edited Jan 12 at 1:22
Rui F Ribeiro
39.5k1479133
edited Jan 12 at 1:22
Rui F Ribeiro
39.5k1479133
edited Jan 12 at 1:22
Rui F Ribeiro
39.5k1479133
39.5k1479133
asked Jan 9 at 21:34
RedSRedS
204
asked Jan 9 at 21:34
RedSRedS
204
asked Jan 9 at 21:34
RedSRedS
204
204
dnsdist is another option. check manual dnsdist.org/rules-actions.html
– ibrahim
Jan 11 at 7:52
add a comment |
dnsdist is another option. check manual dnsdist.org/rules-actions.html
– ibrahim
Jan 11 at 7:52
dnsdist is another option. check manual dnsdist.org/rules-actions.html
– ibrahim
Jan 11 at 7:52
dnsdist is another option. check manual dnsdist.org/rules-actions.html
– ibrahim
Jan 11 at 7:52
add a comment |
1 Answer
1
active
oldest
votes
iptables alone cannot make decisions based on DNS packet content, only by the address and port numbers on the packet headers. At minimum, you would need an iptables extension like iptables-ext-dns.
But it seems to me that you might instead want to do transparent proxying for DNS: you could set the minipc to redirect any outgoing packets going to port 53 (either UDP or TCP) to a DNS server of your choice, and then configure that DNS server to manipulate the answers as you desire. You will be essentially performing a man-in-the-middle attack on all DNS traffic passing through your minipc.
You should also be aware that there are new techniques that aim for cryptographic protection of DNS traffic, like DNS over HTTPS (already supported by Firefox 62 or later) or DNS over TLS.
If your client uses those, a simple redirect of traffic with destination port 53 won't be able to catch those requests - and even if you take extra steps to catch the traffic, the fact that the apparent DNS-over-whatever server has a different certificate than expected will reveal your manipulation.
Also, you should be aware that Youtube could be accessed not only as youtube.com, but also as youtu.be and possibly via other domains too.
answered Jan 9 at 22:29
telcoMtelcoM
16.2k12144
well, I am aware of DNS over random stuff exists, was just curious about the old good DNS server. The MITM part seems a nice idea, means forcing clients to being redirected into my DNS, thats what I was looking for. Thanks!
– RedS
Jan 9 at 22:51
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f493557%2fblock-or-drop-dns-requests-within-forwarded-packets%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
iptables alone cannot make decisions based on DNS packet content, only by the address and port numbers on the packet headers. At minimum, you would need an iptables extension like iptables-ext-dns.
But it seems to me that you might instead want to do transparent proxying for DNS: you could set the minipc to redirect any outgoing packets going to port 53 (either UDP or TCP) to a DNS server of your choice, and then configure that DNS server to manipulate the answers as you desire. You will be essentially performing a man-in-the-middle attack on all DNS traffic passing through your minipc.
You should also be aware that there are new techniques that aim for cryptographic protection of DNS traffic, like DNS over HTTPS (already supported by Firefox 62 or later) or DNS over TLS.
If your client uses those, a simple redirect of traffic with destination port 53 won't be able to catch those requests - and even if you take extra steps to catch the traffic, the fact that the apparent DNS-over-whatever server has a different certificate than expected will reveal your manipulation.
Also, you should be aware that Youtube could be accessed not only as youtube.com, but also as youtu.be and possibly via other domains too.
answered Jan 9 at 22:29
telcoMtelcoM
16.2k12144
well, I am aware of DNS over random stuff exists, was just curious about the old good DNS server. The MITM part seems a nice idea, means forcing clients to being redirected into my DNS, thats what I was looking for. Thanks!
– RedS
Jan 9 at 22:51
add a comment |
iptables alone cannot make decisions based on DNS packet content, only by the address and port numbers on the packet headers. At minimum, you would need an iptables extension like iptables-ext-dns.
But it seems to me that you might instead want to do transparent proxying for DNS: you could set the minipc to redirect any outgoing packets going to port 53 (either UDP or TCP) to a DNS server of your choice, and then configure that DNS server to manipulate the answers as you desire. You will be essentially performing a man-in-the-middle attack on all DNS traffic passing through your minipc.
You should also be aware that there are new techniques that aim for cryptographic protection of DNS traffic, like DNS over HTTPS (already supported by Firefox 62 or later) or DNS over TLS.
If your client uses those, a simple redirect of traffic with destination port 53 won't be able to catch those requests - and even if you take extra steps to catch the traffic, the fact that the apparent DNS-over-whatever server has a different certificate than expected will reveal your manipulation.
Also, you should be aware that Youtube could be accessed not only as youtube.com, but also as youtu.be and possibly via other domains too.
answered Jan 9 at 22:29
telcoMtelcoM
16.2k12144
well, I am aware of DNS over random stuff exists, was just curious about the old good DNS server. The MITM part seems a nice idea, means forcing clients to being redirected into my DNS, thats what I was looking for. Thanks!
– RedS
Jan 9 at 22:51
add a comment |
iptables alone cannot make decisions based on DNS packet content, only by the address and port numbers on the packet headers. At minimum, you would need an iptables extension like iptables-ext-dns.
But it seems to me that you might instead want to do transparent proxying for DNS: you could set the minipc to redirect any outgoing packets going to port 53 (either UDP or TCP) to a DNS server of your choice, and then configure that DNS server to manipulate the answers as you desire. You will be essentially performing a man-in-the-middle attack on all DNS traffic passing through your minipc.
You should also be aware that there are new techniques that aim for cryptographic protection of DNS traffic, like DNS over HTTPS (already supported by Firefox 62 or later) or DNS over TLS.
If your client uses those, a simple redirect of traffic with destination port 53 won't be able to catch those requests - and even if you take extra steps to catch the traffic, the fact that the apparent DNS-over-whatever server has a different certificate than expected will reveal your manipulation.
Also, you should be aware that Youtube could be accessed not only as youtube.com, but also as youtu.be and possibly via other domains too.
answered Jan 9 at 22:29
telcoMtelcoM
16.2k12144
iptables alone cannot make decisions based on DNS packet content, only by the address and port numbers on the packet headers. At minimum, you would need an iptables extension like iptables-ext-dns.
But it seems to me that you might instead want to do transparent proxying for DNS: you could set the minipc to redirect any outgoing packets going to port 53 (either UDP or TCP) to a DNS server of your choice, and then configure that DNS server to manipulate the answers as you desire. You will be essentially performing a man-in-the-middle attack on all DNS traffic passing through your minipc.
You should also be aware that there are new techniques that aim for cryptographic protection of DNS traffic, like DNS over HTTPS (already supported by Firefox 62 or later) or DNS over TLS.
If your client uses those, a simple redirect of traffic with destination port 53 won't be able to catch those requests - and even if you take extra steps to catch the traffic, the fact that the apparent DNS-over-whatever server has a different certificate than expected will reveal your manipulation.
Also, you should be aware that Youtube could be accessed not only as youtube.com, but also as youtu.be and possibly via other domains too.
answered Jan 9 at 22:29
telcoMtelcoM
16.2k12144
answered Jan 9 at 22:29
telcoMtelcoM
16.2k12144
answered Jan 9 at 22:29
telcoMtelcoM
16.2k12144
answered Jan 9 at 22:29
telcoMtelcoM
16.2k12144
16.2k12144
well, I am aware of DNS over random stuff exists, was just curious about the old good DNS server. The MITM part seems a nice idea, means forcing clients to being redirected into my DNS, thats what I was looking for. Thanks!
– RedS
Jan 9 at 22:51
add a comment |
well, I am aware of DNS over random stuff exists, was just curious about the old good DNS server. The MITM part seems a nice idea, means forcing clients to being redirected into my DNS, thats what I was looking for. Thanks!
– RedS
Jan 9 at 22:51
well, I am aware of DNS over random stuff exists, was just curious about the old good DNS server. The MITM part seems a nice idea, means forcing clients to being redirected into my DNS, thats what I was looking for. Thanks!
– RedS
Jan 9 at 22:51
well, I am aware of DNS over random stuff exists, was just curious about the old good DNS server. The MITM part seems a nice idea, means forcing clients to being redirected into my DNS, thats what I was looking for. Thanks!
– RedS
Jan 9 at 22:51
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f493557%2fblock-or-drop-dns-requests-within-forwarded-packets%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
dnsdist is another option. check manual dnsdist.org/rules-actions.html
– ibrahim
Jan 11 at 7:52