Hacker News Reader

Comment by RajT88 | Hacker News Reader

Timely. I've been noticing on flights that the in-flight wifi uses a squid proxy to block you until you pay - but most of the time, you'll get whatever data from the DNS Forwarder even if you haven't paid yet.

I've been noodling on how to build a simple proxy off DNS to test on my next flight.

View on HN

You might be interested in iodine.

https://github.com/yarrick/iodine

A word of caution, don't try this in a corporate environment. Many corporate firewalls will generate security alerts on high DNS request rates. PaloAlto PAN's specifically have alerts for this. I believe Fortigate may as well. Most of the DLP appliances will detect this too. Splunk also has a module to detect this based on query logs. I don't have a horse in the race, just trying to save a few here from a paddlin'.

A regular proxy on port 53 might work? Is it necessary to actually use DNS?

Otherwise there's https://github.com/yarrick/iodine

Edit: seems like others have recommended it already. I got it working in a hotel room once after giving up on the utterly broken ToS acceptance page for the WiFi.

If they do DPI on port 53 traffic to only allow DNS, then it's necessary.

The neat thing about iodine is that it even works when you don't even have access to your home/whatever destination IP address due to the firewall redirecting packets to their server. It uses their resolver as a proxy to access a nameserver that you control, allowing you to exfiltrate data and get an uncensored connection.

Not a proxy but SoftEther VPN supports connection over DNS and/or ICMP. This is meant for circumventing firewalls.

https://www.softether.org/1-features/1._Ultimate_Powerful_VP...!)

udp2raw also supports ICMP tunneling, as a simpler/leaner option that you could run WireGuard over. It's quite performant compared to DNS.

This sort of escape is how Kaminsky ended up as the guy who broke DNS.

(From the opener to https://www.wired.com/2008/11/ff-kaminsky/ )

RIP Dan Kaminsky

Search for iodine

Reply on news.ycombinator.com