5

What is IP-over-DNS tunnelling please?

I have seen this term used in the context of a captive portal. The idea was to redirect clients to the local web server and to force the DNS (?). It was achieved by manipulating the PREROUTING tables. Apparently, this enabled to avoid IP-over-DNS tunelling...

Unfortunately, I can't find the tutorial on which I saw this.

Improve this question
2
  • 2
    I've only seen the term used to describe a network attack where IP packets are tunneled over DNS (UDP port 53). The idea is to bypass firewalls, etc since most let DNS traffic through.
    – Ron Trunk
    Commented Jun 12, 2016 at 16:48
  • 1
    code.kryo.se/iodine
    – paj28
    Commented Jun 12, 2016 at 20:00

2 Answers 2

Reset to default
7

Ron is right with his comment.

IP-over-DNS tunneling (or more common name DNS tunneling) is a kind of attack, that allows to bypass usual network protection and send/receive data over DNS protocol, which tends to be less checked. The downside of it is a bit more complicated setup and the speed is very slow, as all data are sent inside DNS requests, which limits the amount in single packet and requires more packets to be sent.

Some examples where this can be used is to exfiltrate data from protected network, or to browse internet at the paid airport wi-fi. This browsing internet on paid wi-fi is exactly bypassing the captive portal as you have mentioned in your question. As far as I know, it can be avoided by proper configuration of your portal, but I don't have experience with this.

I hope this explanation will make it more clear for you. If you need more information, I would recommned searching for "dns tunneling"

Improve this answer
2
  • 2
    It's not an attack; it's tunneling.
    – Pacerier
    Commented Oct 23, 2017 at 22:21
  • Pacerier is right, DNS tunneling in itself is not yet an attack. However, DNS tunneling is often used to perform e.g. data exfiltration, which of course is an attack.
    – Arthur Khazbulatov
    Commented May 27, 2022 at 10:46
0

It's to tunnel traffic through DNS packets to your router and then onwards to its real destination. It can allow you to use paid access points without actually paying.

Improve this answer
1
  • What can a knife be used for? It can be used to stab people. That is only one use btw.
    – Pacerier
    Commented Oct 23, 2017 at 22:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.