What is IP-over-DNS tunnelling please?

I have seen this term used in the context of a captive portal. The idea was to redirect clients to the local web server and to force the DNS (?). It was achieved by manipulating the PREROUTING tables. Apparently, this enabled to avoid IP-over-DNS tunelling...

Unfortunately, I can't find the tutorial on which I saw this.

  • 2
    I've only seen the term used to describe a network attack where IP packets are tunneled over DNS (UDP port 53). The idea is to bypass firewalls, etc since most let DNS traffic through. – Ron Trunk Jun 12 '16 at 16:48
  • code.kryo.se/iodine – paj28 Jun 12 '16 at 20:00

Ron is right with his comment.

IP-over-DNS tunneling (or more common name DNS tunneling) is a kind of attack, that allows to bypass usual network protection and send/receive data over DNS protocol, which tends to be less checked. The downside of it is a bit more complicated setup and the speed is very slow, as all data are sent inside DNS requests, which limits the amount in single packet and requires more packets to be sent.

Some examples where this can be used is to exfiltrate data from protected network, or to browse internet at the paid airport wi-fi. This browsing internet on paid wi-fi is exactly bypassing the captive portal as you have mentioned in your question. As far as I know, it can be avoided by proper configuration of your portal, but I don't have experience with this.

I hope this explanation will make it more clear for you. If you need more information, I would recommned searching for "dns tunneling"

| improve this answer | |
  • 1
    It's not an attack; it's tunneling. – Pacerier Oct 23 '17 at 22:21

It's to tunnel traffic through DNS packets to your router and then onwards to its real destination. It can allow you to use paid access points without actually paying.

| improve this answer | |
  • What can a knife be used for? It can be used to stab people. That is only one use btw. – Pacerier Oct 23 '17 at 22:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.