Date: Sat, 10 Jun 2000 01:04:03 -0400 From: "purpledreams.com system administrator" <super@purpledreams.com> To: "Andy Dills" <andy@xecu.net> Cc: <freebsd-ipfw@FreeBSD.ORG> Subject: Re: Hijacking DNS with ipfw Message-ID: <003301bfd299$61e21920$a3337218@purpledreams.com> References: <Pine.GSO.4.21.0006092140590.21767-100000@shell.xecu.net>
next in thread | previous in thread | raw e-mail | index | archive | help
But if all you do is redirect the packet to a different port, without NAT, then the result will not be forwarded back correctly. i.e. : 1 - 10.11.12.13 (host) sends DNS to 10.11.13.2 2 - 10.11.12.1 (ipfw gateway) redirects to 127.0.0.1 3 - local DNS answers request, sends results back to 10.11.12.13 without NAT, the packet from number 3 will have a destination of 10.11.12.13 and a source of 10.11.12.1, not 10.11.13.2, and therefore the host making the query won't properly process the packet. NAT would change the source and destination info on the packets (as opposed to merely re-routing them), making them route correctly. all this is, of course, assuming i understand it correctly. it all comes down to the query host receiving the result correctly, not specifically a routing issue at all..... -- dana lacoste purpledreams.com sysadmin FreeBSD since 1997 ----- Original Message ----- From: "Andy Dills" <andy@xecu.net> To: "Cy Schubert - ITSD Open Systems Group" <Cy.Schubert@uumail.gov.bc.ca> Cc: <freebsd-ipfw@FreeBSD.ORG> Sent: Friday, June 09, 2000 9:46 PM Subject: Re: Hijacking DNS with ipfw > On Fri, 9 Jun 2000, Cy Schubert - ITSD Open Systems Group wrote: > > > > I had thought that this rule would cut it: > > > > > > ipfw add 10 fwd 127.0.0.1,53 udp from any to any 53 recv xl1 > > > > > > But that just doesn't work. I'm assuming it's because maybe named gets > > > confused because fwd rules preserve the dest IP (as fwd rules are intended > > > to be used in transparent cacheing). > > > > > > Does anybody have a suggestion on how to approach this? > > > > This just changes the next hop a packet would take to its final > > destination. You'll need to use NAT to do what you want. > > That is correct and incorrect. In my experience and according to the man > page, if the "next hop" is an address on the box in question, it is dumped > into the specified port such that the reply packets have a source address > of the dest addr of the original packet. I'm not forwarding the packet to > another host, I'm forwarding it to localhost so that the DNS server can > handle it. > > Regarding NAT, I am using NAT. However, I'm not interested in DNS packets > leaving my network, as many customers will have DNS servers in private IP > space. So, while I'm doing NAT for everything else, I need to hijack dns > to dump it to the local named. I'm positive this is possible, I'm just not > sure how to do it :> > > Thanks, > Andy > > xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx > Andy Dills 301-682-9972 > Xecunet, LLC www.xecu.net > xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx > Dialup * Webhosting * E-Commerce * High-Speed Access > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-ipfw" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?003301bfd299$61e21920$a3337218>