0

I'm seeing some things in Wireshark I can't explain. My setup is as follows: A router with a single global IP doing NAT for the devices behind it. I am also behind it with my computer. I port forward port 53 external port to my computer also on port 53 in the router (as an experiment).

From that point on, no-one in the network can do NS resolves anymore. Not even me. But the weird thing is that I'm seeing everyone their NS lookup queries in Wireshark arriving on my computer.

Can anyone explain this? I thought that port forwarding was meant to only apply on traffic coming from outside the NAT. It seems like the internal traffic is also being relayed to me. Is this a bug in the router? This seems like a huge security hole.

|improve this question
  • 1
    Can you please provide more information, such as what hardware you're using, what DNS settings you and the other PCs have set, etc? – OzNetNerd Nov 27 '15 at 0:39
  • The DNS setting is provided by DHCP and is set to the router. The router provides the DNS result recursively. So the router will always res.pond with the resolved IP address. – Martijn Courteaux Nov 27 '15 at 1:00
  • 1
    What vendor and model is your router? Would it be possible to post a sanitized copy of your configuration? By the sounds of it the router might be sending the DNS queries out to the internet, but when the responses come back the router forwards them to your PC because of your port forward. Are you sure you're seeing the requests in the capture? Perhaps it is the responses? If you could post a copy of the capture as well that would very helpful too. – OzNetNerd Nov 27 '15 at 2:33
2

Most likely your router acts as a DNS relay. So it doesn't need to know the external DNS servers when you request a IP, using DHCP.

So all clients inside the network think your router is a DNS server, but in fact its just a relay client. So if a client inside the network send s DNS request the ip destination field is the internal address of your router.

By allowing external DNS request to be forwarded you would get the following. A packet with the external ip address arrives at the router. It sees a this is my ip i have to forward it to internal PCx.

Next a internal client sends a DNS packet to the router. again the same thing happens. Because both packets have the router as destination. The router is to 'dumb' to see the packet is arriving on the internal interface(ip) or the external interface(ip).

This isn't really a bug(the industry would call it a feature :P) it has been in many router firmware's. Is just the problem that consumer grade routers are programmed that they don't really see a difference in traffic, where they are the destination. Even when the packet arrives on a totally different interface.

I hope my explanation helps ;)

|improve this answer
  • This explanation makes sense. However there is one more thing: doing the port forward as I described also causes the router to stop acting as a DNS relay. Something like: the router works like: "destination is me: let's see what to do with this... aha, port forward it to x. done." and a check if it was an DNS request would come further in the process. Does this make sense? – Martijn Courteaux Nov 29 '15 at 1:11
0

adding some terminology:

NAT-reflection, also called Hairpinning https://en.wikipedia.org/wiki/Hairpinning

port-forwarding is not generally meant to apply only on traffic from WAN interfaces.

most consumer grade routers i have seen default to Hairpinning and have no option to disable it (unless you a flash custom firmware)

so basically any traffic on that port to your router happens to be forwarded according to your rule, doesn't matter where it came from.

|improve this answer
  • "most consumer grade routers" Consumer-grade devices are explicitly off-topic here. We would be talking about enterprise-grade equipment, which probably does not default to hairpinning, and some cannot even be configured for that. – Ron Maupin♦ Nov 19 '18 at 18:53
  • While I didn't knew the term Hairpinning, this is not the case in my situation. The devices in the LAN were sending DNS requests to the gateway address of the router, and not the external (WAN) address of the router. – Martijn Courteaux Nov 20 '18 at 20:27
  • @RonMaupin i didn't see any info on the that so i just gave the most possible answer i knew of. – csx.cc Nov 22 '18 at 22:16
  • @MartijnCourteaux i think Hairpinning describes just that, your forwarding is active on 'any interface'. can you give us any info on the router? – csx.cc Nov 22 '18 at 22:16
  • See the What Topics Can I Ask About Here? page. – Ron Maupin♦ Nov 22 '18 at 22:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.