0

I have a default Debian 9 installed in minipc, which is forwarding packets further.

I wish to be able to block hosts via domains, means if any forwarded packet of DNS type has request for example of youtube.com, it should be dropped. I know there are methods to drop them within iptables rules, but it is not advised technique.

I am afraid that setting dnsmasq or bind wont work, since few computers has google's 8.8.8.8 DNS server hardcoded (Few IoT devices).

So is there a way to either:

  • force DNS resolving via my dnsmasq/bind (so i can setup a blacklist)
  • drop DNS request packets containing 'youtube.com' without iptables

Any ideas?

2

iptables alone cannot make decisions based on DNS packet content, only by the address and port numbers on the packet headers. At minimum, you would need an iptables extension like iptables-ext-dns.

But it seems to me that you might instead want to do transparent proxying for DNS: you could set the minipc to redirect any outgoing packets going to port 53 (either UDP or TCP) to a DNS server of your choice, and then configure that DNS server to manipulate the answers as you desire. You will be essentially performing a man-in-the-middle attack on all DNS traffic passing through your minipc.

You should also be aware that there are new techniques that aim for cryptographic protection of DNS traffic, like DNS over HTTPS (already supported by Firefox 62 or later) or DNS over TLS.

If your client uses those, a simple redirect of traffic with destination port 53 won't be able to catch those requests - and even if you take extra steps to catch the traffic, the fact that the apparent DNS-over-whatever server has a different certificate than expected will reveal your manipulation.

Also, you should be aware that Youtube could be accessed not only as youtube.com, but also as youtu.be and possibly via other domains too.

  • well, I am aware of DNS over random stuff exists, was just curious about the old good DNS server. The MITM part seems a nice idea, means forcing clients to being redirected into my DNS, thats what I was looking for. Thanks! – RedS Jan 9 at 22:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.