0

I have a Linux VPS serving data on the internet that has a legitimate Domain name and SSL Certificate ( from GoDaddy.com ). I will refere to this server as "www.myserver.com". I also have a local Linux machine ( on my own LAN ) that I want to use to DNS spoof my internet facing Domain name ( www.myserver.com ) to it's own NGINX webserver running on that local machine.

I setup DNSMasq on the local machine to spoof that domain to it's local 192.x address and I verified from another machine on the LAN that dig reports the local address.

Local server dnsmaq spoof mapping:

cat /etc/dnsmasq.d/spoof.hosts 
192.168.1.142 www.myserver.com myserver.com

Separate machine on LAN shows that spoofed mapping should work:

dig +short @192.168.1.142 myserver.com
>> 192.168.1.142

My dnsmasq.conf:

server=127.0.0.1
listen-address=127.0.0.1
listen-address=192.168.1.142
no-dhcp-interface=
no-hosts
addn-hosts=/etc/dnsmasq.d/spoof.hosts

My spoof.hosts:

192.168.1.142 www.myserver.com myserver.com

On the local server, I configured NGINX with resolver to look to localhost for DNS as shown here:

http {

    access_log off;
    include mime.types;

    default_type html;

    sendfile        on;

    keepalive_requests 50;
    keepalive_timeout  75s;

    reset_timedout_connection on;

    server_tokens off;

    server {

       listen 8080 default_server;

       resolver 127.0.0.1 valid=10s;

       location / {
           return 302 http://myserver.com/;
       }

    }

    server {

      listen       80;
      server_name *.myserver.com;

      // Various Endpoints

    }
}

The problem is that when I visit my local machine 192.168.1.131:8080, it redirects to my actual internet facing machine - the real domain name on the internet.

I want it to redirect to the local spoofed DNS. What am I doing wrong? How can I accomplish this? Thank you.

UPDATE: I've tried this as well but no luck:

http {
    access_log off;
    include mime.types;

    default_type html;

    sendfile        on;

    keepalive_requests 50;
    keepalive_timeout  75s;

    reset_timedout_connection on;

    server_tokens off;

    server {

          listen 80 default_server;
          server_name _;
      resolver 127.0.0.1;
          return 301 https://myserver.com/$request_uri;   

    }

    server {

        listen       443;
    server_name *.myserver.com;

    ssl on;
    ssl_certificate /etc/nginx/ssl/1e17e6d8f94cc4ee.crt;
        ssl_certificate_key /etc/nginx/ssl/example.com.key;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2; 
        ssl_prefer_server_ciphers on;
        ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

    ...

    }
}
  • can you please add the output of curl -Iv 192.168.1.131:8080 to the question? – Rabin Feb 11 '18 at 22:32
2

When nginx sends a redirect, it simply tells the client to visit the new URL. So now on the client the new hostname is resolved, and as that client is not using the spoofing DNS server, it goes to the real host.

Perhaps you want to use nginx in proxy mode, so that nginx is fetching the content from the backend and relaying that on to the client.

1

Your nginx won't need to resolve anything at all when it sends the redirect - it literally just tells the clients "go to https://myserver.com instead".

Then the client, on its own, uses the DNS servers it has been configured with, to look up the IP address of myserver.com.

You need to make sure the client will use 192.168.1.142 and nothing else as its DNS server.

1

If I correctly understand, you have two machines of interest on your LAN: Let's call them 142 (which stands for 192.168.2.142) and 131 (standing for 192.168.1.131).

If I still correctly understand, when you connect from 131 to 131:8080 you want to be forwarded to 142, spoofing www.myserver.com.

If that is the case, you need to have DNSMasq running on 131, not on 142.

What you need to verify is that

$ dig +short myserver.com   # running on 131, no @parameter
>> 192.168.1.142

If, on the other hand, you have more machines that when connecting to 131:8080 should be redirected to 142 spoofing www.myserver.com, you need all those machines to use your instance of DNSMasq as their default DNS server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.