5 ms·

DNS happens over port 53

oliwarner 8y ago
Yes. I'm saying in my experience everything but 80/443 are blocked. Completely. 80/443 get redirected. Edited parent for clarity.
- iforgotpassword 8y ago
  Then how can they redirect you to anything in the first place? I type www.google.com in my browser and then what exactly happens next on the IP level? Think about it...
  - pixl97 8y ago
    DNS isn't secure, all they have to do is capture and answer all queries on unauthenticated IPs. No route to the internet needed.
    - iforgotpassword 8y ago
      They can't do that. If they reply with a bogus IP then after you authenticate to the CP, you cannot access the website you tried to access in the first place (eg google) because now your browser has cached the wrong IP address that it got earlier. So they need to lookup the actual IP address on your behalf and then in turn redirect traffic to that IP to their CP. boom, you just managed to communicate to the outside world.
      - willstrafach 8y ago
        They could just set a low TTL
        iforgotpassword 8y ago
        No they couldn't, unless they expect everyone to use a browser that is vulnerable to DNS rebind attacks, which probably means some browser from the 90s.
        r1ch 8y ago
        Every browser is vulnerable to DNS rebind attacks, since the burden of "fixing" it has been pushed onto the applications that are getting traffic forwarded by the browser. Also services like Cloudflare wouldn't work if low TTLs didn't work. CF rotate IPs often as part of their DDoS protection.
        fps_doug 8y ago
        They still do. Not like when DNS rebind was all the rage, where Firefox decided to cache DNS replies forever, but they still bump the TTL to a minimum of several minutes, which is enough to confuse people in the CP scenario. I wouldn't be surprised if some OS resolvers did the same, possibly just for performance reasons even. And that's all fine and dandy since those couple minutes don't break the Cloudflare scenario. I mean, if it weren't the case, why would CPs work in that way then anyways? It wouldn't be an issue to have a DNS server in the mix that resolves everything to you CP address with a TTL of one second, and then additionally to your port 80 TCP redirect just add another one for 53 UDP. It's not being done by any CP solution I have ever encountered.
  - oliwarner 8y ago
    Sure, yup, oversimplifying to make the point. They are also transparently redirecting DNS to their own server. My point is you can't "tunnel" out. Not for DNS, VPN or whatever. It's all blocked. The only services they let you access are their own to get you to authenticate. Even if you walked in with a complete hosts file (so didn't need to query any DNS server), you'd still not be allowed to connect, at firewall level until you authenticated.
    - wdroz 8y ago
      Two ways for doing DNS tunneling: 1. direct way, you pass to your server through port 53. 2. indirect way, you pass through a "official" domain that you own and make the DNS of where you are communicate with your server. For 1. it's not open very often, indeed. But for 2. I see it open all the time, even in banks...
      - oliwarner 8y ago
        What are you tunnelling to? In a proper captive portal, it's blocked. I'm not talking about just blocking DNS. Or just blocking know DNS services. A good captive portal just denies everything save the web/dns traffic redirected to an internal server running on the portal. That is until you log in and get explicit allow rights. If your portal isn't doing this, if you can escape and actually connect to external IPs, it's not captive.
    - iforgotpassword 8y ago
      > They are also transparently redirecting DNS to their own server. Yes that's expected. So what does their DNS server do when I ask it for the IP address of google.com?
      - taejo 8y ago
        Give you the IP address of their captive portal.
      - oliwarner 8y ago
        It could reply with anything, even a valid, correct response. The connection you make to that result is still going to be redirected to the portal.

Yes. I'm saying in my experience everything but 80/443 are blocked. Completely. 80/443 get redirected. Edited parent for clarity.

iforgotpassword 8y ago
Then how can they redirect you to anything in the first place? I type www.google.com in my browser and then what exactly happens next on the IP level? Think about it...
- pixl97 8y ago
  DNS isn't secure, all they have to do is capture and answer all queries on unauthenticated IPs. No route to the internet needed.
  - iforgotpassword 8y ago
    They can't do that. If they reply with a bogus IP then after you authenticate to the CP, you cannot access the website you tried to access in the first place (eg google) because now your browser has cached the wrong IP address that it got earlier. So they need to lookup the actual IP address on your behalf and then in turn redirect traffic to that IP to their CP. boom, you just managed to communicate to the outside world.
    - willstrafach 8y ago
      They could just set a low TTL
      - iforgotpassword 8y ago
        No they couldn't, unless they expect everyone to use a browser that is vulnerable to DNS rebind attacks, which probably means some browser from the 90s.
        r1ch 8y ago
        Every browser is vulnerable to DNS rebind attacks, since the burden of "fixing" it has been pushed onto the applications that are getting traffic forwarded by the browser. Also services like Cloudflare wouldn't work if low TTLs didn't work. CF rotate IPs often as part of their DDoS protection.
        fps_doug 8y ago
        They still do. Not like when DNS rebind was all the rage, where Firefox decided to cache DNS replies forever, but they still bump the TTL to a minimum of several minutes, which is enough to confuse people in the CP scenario. I wouldn't be surprised if some OS resolvers did the same, possibly just for performance reasons even. And that's all fine and dandy since those couple minutes don't break the Cloudflare scenario. I mean, if it weren't the case, why would CPs work in that way then anyways? It wouldn't be an issue to have a DNS server in the mix that resolves everything to you CP address with a TTL of one second, and then additionally to your port 80 TCP redirect just add another one for 53 UDP. It's not being done by any CP solution I have ever encountered.
- oliwarner 8y ago
  Sure, yup, oversimplifying to make the point. They are also transparently redirecting DNS to their own server. My point is you can't "tunnel" out. Not for DNS, VPN or whatever. It's all blocked. The only services they let you access are their own to get you to authenticate. Even if you walked in with a complete hosts file (so didn't need to query any DNS server), you'd still not be allowed to connect, at firewall level until you authenticated.
  - wdroz 8y ago
    Two ways for doing DNS tunneling: 1. direct way, you pass to your server through port 53. 2. indirect way, you pass through a "official" domain that you own and make the DNS of where you are communicate with your server. For 1. it's not open very often, indeed. But for 2. I see it open all the time, even in banks...
    - oliwarner 8y ago
      What are you tunnelling to? In a proper captive portal, it's blocked. I'm not talking about just blocking DNS. Or just blocking know DNS services. A good captive portal just denies everything save the web/dns traffic redirected to an internal server running on the portal. That is until you log in and get explicit allow rights. If your portal isn't doing this, if you can escape and actually connect to external IPs, it's not captive.
  - iforgotpassword 8y ago
    > They are also transparently redirecting DNS to their own server. Yes that's expected. So what does their DNS server do when I ask it for the IP address of google.com?
    - taejo 8y ago
      Give you the IP address of their captive portal.
    - oliwarner 8y ago
      It could reply with anything, even a valid, correct response. The connection you make to that result is still going to be redirected to the portal.