3 ms·

Sure, yup, oversimplifying to make the point. They are also transparently redirecting DNS to their own server. My point is you can't "tunnel" out. Not for DNS,

Sure, yup, oversimplifying to make the point. They are also transparently redirecting DNS to their own server. My point is you can't "tunnel" out. Not for DNS, VPN or whatever. It's all blocked. The only services they let you access are their own to get you to authenticate. Even if you walked in with a complete hosts file (so didn't need to query any DNS server), you'd still not be allowed to connect, at firewall level until you authenticated.

wdroz 8y ago
Two ways for doing DNS tunneling: 1. direct way, you pass to your server through port 53. 2. indirect way, you pass through a "official" domain that you own and make the DNS of where you are communicate with your server. For 1. it's not open very often, indeed. But for 2. I see it open all the time, even in banks...
- oliwarner 8y ago
  What are you tunnelling to? In a proper captive portal, it's blocked. I'm not talking about just blocking DNS. Or just blocking know DNS services. A good captive portal just denies everything save the web/dns traffic redirected to an internal server running on the portal. That is until you log in and get explicit allow rights. If your portal isn't doing this, if you can escape and actually connect to external IPs, it's not captive.
iforgotpassword 8y ago
> They are also transparently redirecting DNS to their own server. Yes that's expected. So what does their DNS server do when I ask it for the IP address of google.com?
- taejo 8y ago
  Give you the IP address of their captive portal.
- oliwarner 8y ago
  It could reply with anything, even a valid, correct response. The connection you make to that result is still going to be redirected to the portal.
  - fps_doug 8y ago
    > It could reply with anything, even a valid, correct response. Which you actually need to do, to prevent locking the user out from the website they tried to access in the first place after authenticating, thanks to DNS pinning. > The connection you make to that result is still going to be redirected to the portal. Correct, but who cares? This is about DNS tunneling, there will be no connection anywhere, the DNS queries and their replies ARE the connection, so to say. How about reading up on what a DNS tunnel actually is? Considering your posts in this thread you have no clue how it works or at least have huge misconceptions about it.

wdroz 8y ago

Two ways for doing DNS tunneling: 1. direct way, you pass to your server through port 53. 2. indirect way, you pass through a "official" domain that you own and make the DNS of where you are communicate with your server. For 1. it's not open very often, indeed. But for 2. I see it open all the time, even in banks...

oliwarner 8y ago
What are you tunnelling to? In a proper captive portal, it's blocked. I'm not talking about just blocking DNS. Or just blocking know DNS services. A good captive portal just denies everything save the web/dns traffic redirected to an internal server running on the portal. That is until you log in and get explicit allow rights. If your portal isn't doing this, if you can escape and actually connect to external IPs, it's not captive.

iforgotpassword 8y ago

> They are also transparently redirecting DNS to their own server. Yes that's expected. So what does their DNS server do when I ask it for the IP address of google.com?

taejo 8y ago
Give you the IP address of their captive portal.
oliwarner 8y ago
It could reply with anything, even a valid, correct response. The connection you make to that result is still going to be redirected to the portal.
- fps_doug 8y ago
  > It could reply with anything, even a valid, correct response. Which you actually need to do, to prevent locking the user out from the website they tried to access in the first place after authenticating, thanks to DNS pinning. > The connection you make to that result is still going to be redirected to the portal. Correct, but who cares? This is about DNS tunneling, there will be no connection anywhere, the DNS queries and their replies ARE the connection, so to say. How about reading up on what a DNS tunnel actually is? Considering your posts in this thread you have no clue how it works or at least have huge misconceptions about it.