7 ms·

Players tunnel SSH through DNS. iodine is one of the many tools to do that. The best are not distributed, to avoid creation of DPI rules. cloudflare is doing

by 1996 7y ago

Players tunnel SSH through DNS. iodine is one of the many tools to do that. The best are not distributed, to avoid creation of DPI rules. cloudflare is doing something similar on 1.1.1.1 with wireguard.

jtchang 7y ago
Stuffing TXT messages in DNS queries inside DNS queries tends to be quite slow.
- pastage 7y ago
  Yes but at times you can actually receive data normally it just that sending it will be blocked. So download bandwidth is MB/S and upload is relly slow. Some times port 53 to anywhere is available so you don't evwn need to tunnel over dns.
- 1996 7y ago
  If your firewall doesn't let SSH go through, step1) different port like 81, step2) udp tunnel like openvpn (pick your port, SIP sometimes work), step3) tcp inside ssl tunnel on port 443, step4) http tunnel on port 80, step5) dns on port 53 Don't go to step5 if anything else work because yes, it's slow. I don't use ICMP but some people do.
djsumdog 7y ago
iodine is great for getting free Wi-Fi too. Most captive portals don't block DNS, but just do HTTP redirects. You can pump all your traffic over DNS to an iodine server you have setup on a VM (it's not encrypted, so for the very paranoid, run OpenVPN or Wireguard through your iodine tunnel). Note: this is most likely illegal .. in every jurisdiction. So .. don't actually do this.
- QualityReboot 7y ago
  > Note: this is most likely illegal .. in every jurisdiction. So .. don't actually do this. Sad if true. If a service is providing public DNS access without any service agreement, I don't see how making DNS queries with it could be illegal, especially on a public radio channel. You might be right, but how? It's certainly within their right to ban you by filtering out certain queries though.
  - AdamJacobMuller 7y ago
    It's theft of service. Remember as abstract as the law can be, the legal system is not going to be amused by contrivances like "they were offering DNS service free and clear, so tunneling youtube over DNS is fine" The legal system is going to understand that you were trying to circumvent paying for services and treat it appropriately.
    - QualityReboot 7y ago
      How can it be theft of service when they can deny you service at any time automatically by identifying abnormally heavy users and removing them? This isn't like bypassing the electrical grid by running your own line from somebody else's service. This is like saying it's theft of service to read a chapter in the bookstore. If you hang out there all day, you might get kicked out, but that's not a crime. The courts might agree with you, but only because "computers are hard". There's a world of difference between tunneling over DNS and compromising servers. Or at least, there should be.
      - blackflame 7y ago
        "by identifying abnormally heavy users and removing them" - That costs money, ergo, theft. It's like if someone had to hire a security guard for a vending machine.
        QualityReboot 7y ago
        Or even just let those users alone. Users aren't stealing service if it's not even the same service. It's much slower than buying wifi from the captive portal. DNS tunnelling is not fast or convenient. Places deploying captive portals have probably looked at the risk to their business from it and have decided not to worry about it. I can't believe that using a slow DNS connection, intentionally made public, to tunnel traffic would be considered theft or criminal. How many free samples do I have to eat before I'm a theif? I don't believe I'm a thief until the offer for free samples is rescinded.
- angry_octet 7y ago
  Why would it be illegal? Maybe unwise, or against your employer's policy, but not illegal.
  - QualityReboot 7y ago
    As best as I can tell from this thread, if you make use of any service in any way that could be interpreted as unintended by the service provider, you're a criminal. It makes me wonder if using 1.1.1.1 on my network is a crime. Sure my ISP is letting my DNS queries through, but think of all the analytics that they're missing about me.
    - angry_octet 7y ago
      That is not the case, at least in most occidental jurisdictions. See for example the recent linkedin case: https://www.theverge.com/2019/9/10/20859399/linkedin-hiq-data-scraping-cfaa-lawsuit-ninth-circuit-ruling https://www.theverge.com/2019/9/10/20859399/linkedin-hiq-dat... And the CFAA is a peculiarly poor bit of legislation, even by US standards, nothing like it applies in the EU. There is no basis to say these actions, or using a different DNS, is criminal. At worst a contract dispute.
porjo 7y ago
> cloudflare is doing something similar on 1.1.1.1 with wireguard. The primary maintainer of Wireguard had some misgivings about that: https://lists.zx2c4.com/pipermail/wireguard/2019-March/004048.html https://lists.zx2c4.com/pipermail/wireguard/2019-March/00404...
- 1996 7y ago
  cloudflare is not our friend, but another google/facebook in the making
LinuxBender 7y ago
A former coworker and I used to do friendly red-team/blue-team challenges with each other. He tunneled traffic through a test DNS server and my goal was to limit the usefulness or block it. Blocking it was very difficult. I had to limit window sizes. Unbound can do this native. With bind I had to use iptables. Both Unbound and Bind could limit the packet rate. Unbound had the most granular controls around limits per domain/tld/ip. Tampering with window sizes would most certainly break some things, like DNSSEC and zone transfers.

by 1996 7y ago

jtchang 7y ago

Stuffing TXT messages in DNS queries inside DNS queries tends to be quite slow.

pastage 7y ago
Yes but at times you can actually receive data normally it just that sending it will be blocked. So download bandwidth is MB/S and upload is relly slow. Some times port 53 to anywhere is available so you don't evwn need to tunnel over dns.
1996 7y ago
If your firewall doesn't let SSH go through, step1) different port like 81, step2) udp tunnel like openvpn (pick your port, SIP sometimes work), step3) tcp inside ssl tunnel on port 443, step4) http tunnel on port 80, step5) dns on port 53 Don't go to step5 if anything else work because yes, it's slow. I don't use ICMP but some people do.

djsumdog 7y ago

iodine is great for getting free Wi-Fi too. Most captive portals don't block DNS, but just do HTTP redirects. You can pump all your traffic over DNS to an iodine server you have setup on a VM (it's not encrypted, so for the very paranoid, run OpenVPN or Wireguard through your iodine tunnel). Note: this is most likely illegal .. in every jurisdiction. So .. don't actually do this.

QualityReboot 7y ago
> Note: this is most likely illegal .. in every jurisdiction. So .. don't actually do this. Sad if true. If a service is providing public DNS access without any service agreement, I don't see how making DNS queries with it could be illegal, especially on a public radio channel. You might be right, but how? It's certainly within their right to ban you by filtering out certain queries though.
- AdamJacobMuller 7y ago
  It's theft of service. Remember as abstract as the law can be, the legal system is not going to be amused by contrivances like "they were offering DNS service free and clear, so tunneling youtube over DNS is fine" The legal system is going to understand that you were trying to circumvent paying for services and treat it appropriately.
  - QualityReboot 7y ago
    How can it be theft of service when they can deny you service at any time automatically by identifying abnormally heavy users and removing them? This isn't like bypassing the electrical grid by running your own line from somebody else's service. This is like saying it's theft of service to read a chapter in the bookstore. If you hang out there all day, you might get kicked out, but that's not a crime. The courts might agree with you, but only because "computers are hard". There's a world of difference between tunneling over DNS and compromising servers. Or at least, there should be.
    - blackflame 7y ago
      "by identifying abnormally heavy users and removing them" - That costs money, ergo, theft. It's like if someone had to hire a security guard for a vending machine.
      - QualityReboot 7y ago
        Or even just let those users alone. Users aren't stealing service if it's not even the same service. It's much slower than buying wifi from the captive portal. DNS tunnelling is not fast or convenient. Places deploying captive portals have probably looked at the risk to their business from it and have decided not to worry about it. I can't believe that using a slow DNS connection, intentionally made public, to tunnel traffic would be considered theft or criminal. How many free samples do I have to eat before I'm a theif? I don't believe I'm a thief until the offer for free samples is rescinded.
angry_octet 7y ago
Why would it be illegal? Maybe unwise, or against your employer's policy, but not illegal.
- QualityReboot 7y ago
  As best as I can tell from this thread, if you make use of any service in any way that could be interpreted as unintended by the service provider, you're a criminal. It makes me wonder if using 1.1.1.1 on my network is a crime. Sure my ISP is letting my DNS queries through, but think of all the analytics that they're missing about me.
  - angry_octet 7y ago
    That is not the case, at least in most occidental jurisdictions. See for example the recent linkedin case: https://www.theverge.com/2019/9/10/20859399/linkedin-hiq-data-scraping-cfaa-lawsuit-ninth-circuit-ruling https://www.theverge.com/2019/9/10/20859399/linkedin-hiq-dat... And the CFAA is a peculiarly poor bit of legislation, even by US standards, nothing like it applies in the EU. There is no basis to say these actions, or using a different DNS, is criminal. At worst a contract dispute.

porjo 7y ago

> cloudflare is doing something similar on 1.1.1.1 with wireguard. The primary maintainer of Wireguard had some misgivings about that: https://lists.zx2c4.com/pipermail/wireguard/2019-March/004048.html https://lists.zx2c4.com/pipermail/wireguard/2019-March/00404...

1996 7y ago
cloudflare is not our friend, but another google/facebook in the making

LinuxBender 7y ago

A former coworker and I used to do friendly red-team/blue-team challenges with each other. He tunneled traffic through a test DNS server and my goal was to limit the usefulness or block it. Blocking it was very difficult. I had to limit window sizes. Unbound can do this native. With bind I had to use iptables. Both Unbound and Bind could limit the packet rate. Unbound had the most granular controls around limits per domain/tld/ip. Tampering with window sizes would most certainly break some things, like DNSSEC and zone transfers.