4 ms·

There's also iodine, a C program that tunnels IPv4 packets over DNS. Useful for bypassing captive portals on wifi, since DNS usually isn't restricted. https://

There's also iodine, a C program that tunnels IPv4 packets over DNS. Useful for bypassing captive portals on wifi, since DNS usually isn't restricted. https://github.com/yarrick/iodine https://github.com/yarrick/iodine Regarding cloudflare DNS over HTTPS: It could be that it tries to server data encoded as JSON, which is impossible in JSON. Some control characters and bytes 128-255 cannot be represented as JSON strings.

OJFord 3y ago
IME they block DNS other than their own (not even rewrite, just outright block). Not through experience trying to use iodine, but because I frequently have to drop my explicit DNS server in order to be able to reach the captive portal and connect legitimately.
- smashed 3y ago
  Of course. A captive portal can also be more sneaky and mangle the packets to redirect them to their own DNS service, since it's not encrypted. But that's the beauty of iodine. It will still work because if the captive portal's name servers actually fully resolve requests, it will contact your upstream iodine controlled name servers and forward the response as-is, because that's just how DNS works. Of course it's also fairly easy to detect/block since your DNS usage will be completely abnormal.
- jesprenj 3y ago
  Yeah, like a sibling comment replied, the idea of iodine is that you don't use your own resolver but the one that the captive portal provided. You need a domain name, xxx.example, then you can uplink data yyyyyy through the tunnel by querying yyyyyy.xxx.example and iodined, authoritative for xxx.example, will receive this query by the captive portal's resolver. To downlink data, you read responses (txt, cname or null records) that iodined will send for your queries. This probably fills up the cache of the captive portal's resolver (:
  - OJFord 3y ago
    Oh I see. I'm surprised if they upstream DNS requests though, it doesn't serve any legitimate purpose? The whole point is that they respond 172.16.0.1 or whatever for the CP to everything? (Until MAC address known or however they track.)
    - jesprenj 3y ago
      Sometimes they require 3rd party stuff, hotlinked images, js on frontpage, etc. I was on a ferry ship with paid sattelite wifi internet once and they only faked DNS responses for gstatic.com, google, etc. But they allowed my domain (DNS queries to it) and stripe.com (because that's how you paid) -- so they only faked responses for a small set of popular domains. IP access to the internet was, apart from stripe, blocked. And because stripe uses FastlyCDN, they allowed all of fastlycdn network ranges (not useful for iodine), so I could browse reddit (they also use fastly) using stripe's CDN (only html, without i.redd.it image hosting, that's elsewhere). AFAIR Fastly doesn't have a free plan, so I couldn't tunnel at higher speeds (via HTTP) but only via DNS. But yeah, sometimes they just outright respond to any query with their IP and you are out of luck.

OJFord 3y ago

IME they block DNS other than their own (not even rewrite, just outright block). Not through experience trying to use iodine, but because I frequently have to drop my explicit DNS server in order to be able to reach the captive portal and connect legitimately.

smashed 3y ago
Of course. A captive portal can also be more sneaky and mangle the packets to redirect them to their own DNS service, since it's not encrypted. But that's the beauty of iodine. It will still work because if the captive portal's name servers actually fully resolve requests, it will contact your upstream iodine controlled name servers and forward the response as-is, because that's just how DNS works. Of course it's also fairly easy to detect/block since your DNS usage will be completely abnormal.
jesprenj 3y ago
Yeah, like a sibling comment replied, the idea of iodine is that you don't use your own resolver but the one that the captive portal provided. You need a domain name, xxx.example, then you can uplink data yyyyyy through the tunnel by querying yyyyyy.xxx.example and iodined, authoritative for xxx.example, will receive this query by the captive portal's resolver. To downlink data, you read responses (txt, cname or null records) that iodined will send for your queries. This probably fills up the cache of the captive portal's resolver (:
- OJFord 3y ago
  Oh I see. I'm surprised if they upstream DNS requests though, it doesn't serve any legitimate purpose? The whole point is that they respond 172.16.0.1 or whatever for the CP to everything? (Until MAC address known or however they track.)
  - jesprenj 3y ago
    Sometimes they require 3rd party stuff, hotlinked images, js on frontpage, etc. I was on a ferry ship with paid sattelite wifi internet once and they only faked DNS responses for gstatic.com, google, etc. But they allowed my domain (DNS queries to it) and stripe.com (because that's how you paid) -- so they only faked responses for a small set of popular domains. IP access to the internet was, apart from stripe, blocked. And because stripe uses FastlyCDN, they allowed all of fastlycdn network ranges (not useful for iodine), so I could browse reddit (they also use fastly) using stripe's CDN (only html, without i.redd.it image hosting, that's elsewhere). AFAIR Fastly doesn't have a free plan, so I couldn't tunnel at higher speeds (via HTTP) but only via DNS. But yeah, sometimes they just outright respond to any query with their IP and you are out of luck.