1

I'm attempting to force all hosts on my LAN to use a specific DNS server to filter certain material, however I'm running into problems.

I've had problems in the past trying to configure my router's DHCP to assign the desired DNS server to hosts because some users have simply learned to set their own DNS server (Google's 8.8.8.8, for example) on computer.

Currently, I have an ARP poisoning script to redirect all traffic from the gateway router to my machine. Meanwhile, I have a second python script listening for Port 53 traffic so I can intercept the DNS lookup packets, modify the destination IP from the original DNS server to the desired DNS server, then send them on towards the new DNS server.

Am I thinking about this the right way?

Is there an easier way to force users onto a certain DNS server?

It seems like I'm not even getting any traffic on my machine for port 53, even though the firewall for that port is open, so I don't even have the chance to view the DNS request packets when a user is trying to resolve a dns lookup, let alone modify the packet.

It's not as simple as setting up port rules on a router, because this may be implemented on LANS with routers that don't have very sophisticated firewall settings, and also I don't want to always force ALL hosts to use the specified DNS server -- I want an option to whitelist certain devices.

I would really appreciate any feedback or help. Thanks!

Note: This was originally posted on the Security Stack Exchange, however it was recommended I ask here as well.

Improve this question
4
  • 2
    I think a much simpler way would be to block all DNS at your firewall except to those servers you deem appropriate. If you only want your internal DNS servers resolving external queries, then permit only those servers through the firewall. If your users try to change their DNS servers, that traffic is simply blocked. If you're having trouble using a specific technology, e.g. Cisco Umbrella, you should update the question accordingly so a more specific answer could be given.
    – boomi
    Commented Sep 23, 2018 at 0:31
  • 1
    @boomi That's exactly what I was going to suggest instead. Much easier and fewer headaches.
    – Jesse P.
    Commented Sep 23, 2018 at 2:37
  • 1
    ARP poisoning can't do this since only local addresses are ARPed. Remote addresses would need to be redirected on a router.
    – Zac67 ♦
    Commented Sep 23, 2018 at 7:43
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 25, 2018 at 9:35

2 Answers 2

Reset to default
1

You wouldn't use ARP poisoning, simply create a rule(s) in the firewall for allowing traffic to the whitelisted DNS server(s), then a rule to deny DNS traffic.

The reason it won't work is as was answered in the comments by Zac67, ARP is only used on LANs. The DNS is on a public network.

Improve this answer
1

If you want to reroute all traffic to the default gateway through your machine it's much more reliable to set your machine as default gateway in the first place. Unless you completely stop (filter) normal ARP, ARP poisioning won't be able to fool 100% of your nodes.

Even so, if your users are able to change their DNS setup they might be able to work around the poisoning, too - they just need to set up static ARP to the original gateway. ARP poisoning is more of an attack method or a last resort rather than a regular mode of operation.

Additionally, if you don't want your users to use random DNS servers, just leave the default gateway be and configure the firewall to filter that traffic and permit only the server(s) you want. In a controlled environment, you'd do that anyway.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.