Learn how easy is to bypass firewalls using DNS tunneling (and also how to block it)

photo by Rob Bye on Unsplash

1. What is it and why would someone use it:

Hotels generally provide an access code if you ask… but we all have introvert days.

2. How does it work:

I should have been an artist but I just loved subnetting too much.

3. Step by step example using iodine:

It can do more than emulating Street Fighter 2 turbo apparently.
If you’re in the right path you should see this message.
It is important to use tools that make you look professional.
iodine tries many encoding methods to see which is more suitable.
dns0 will now appear under your client’s network interfaces
You should be able to ping the server, even SSH into it. All through your fresh DNS tunnel.

4. Blocking DNS tunneling on your network (with an example!):

# alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:”APP-DETECT iodine dns tunnelling handshake server ACK”; flow:to_client; byte_test:1,&,0x80,2; content:”|00 01 00 01 00|”; depth:5; offset:4; content:”v”; within:1; distance:4; content:”VACK”; within:200; fast_pattern; metadata:service dns; reference:url,code.kryo.se/iodine/README.html; classtype:policy-violation; sid:27046; rev:2;)

Blocking DNS Tunnel — An example:

I blocked social networking sites on the URL filtering engine and soon I was browsing them again.
Basic application usage analysis on a Palo Alto Networks firewall
First I create an Application Filter for Evasive apps with a high risk rating. Notice tcp-over-dns is in the list.
Second I define that this will be for traffic sourced from inside my network.
And finally, we make the rule Deny all this traffic. Check this article to see what is the difference between a Deny or a Drop.
.. and apparently iodine can’t establish a tunnel anymore!
Always match the color of your balaclava with your vest.

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store