4 ms·
This would still allow data exfiltration via DNS. It really needs to be done at the browser level.
by r1ch 5y ago
This would still allow data exfiltration via DNS. It really needs to be done at the browser level.
- boring_twenties 5y agoThis rule blocks all IP traffic including DNS requests.
- r1ch 5y agoIt only blocks IPv4 traffic, so on an IPv6 enabled host it can easily be bypassed without even involving DNS. But assuming an IPv4-only host, on a system using nscd, DNS lookup is performed over a Unix socket: Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 23 1445 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 owner UID match 1007 # setuidgid outtest ping -n 1 -4 google.com PING google.com (142.250.102.100) 56(124) bytes of data.
- boring_twenties 5y agoThat's interesting. I've never used nscd, but the rule seems to work against both dnsmasq and systemd-resolved which just listen on loopback port 53. As for IPv6 you can obviously just apply a similar rule using ip6tables (or the newer nftables, which I don't know how to use.)