dns2tcpd: A server-side tool for handling DNS-based TCP tunneling

What is DNS2TCPd?

DNS2TCPd is a tool that allows tunneling TCP traffic over DNS queries. It is useful in restricted network environments where only DNS traffic is allowed (e.g., in heavily firewalled networks). By encapsulating TCP data inside DNS packets, it bypasses network restrictions.

Key Features:

• Encapsulates TCP traffic in DNS queries/responses.
• Works where only DNS (port 53) is allowed.
• Useful for bypassing firewalls and censorship.
• Lightweight and easy to configure.

How DNS2TCPd Works

DNS2TCPd operates as a server that listens for DNS queries containing encoded TCP data. The workflow is:

1. A client (e.g., dns2tcpc) sends DNS queries with encoded TCP data.
2. The DNS2TCPd server decodes the queries, forwards the TCP traffic to the intended destination, and sends back responses inside DNS replies.
3. The client decodes the DNS responses to reconstruct the original TCP data.

Protocol Details:

• Uses TXT, CNAME, or NULL DNS records for data transfer.
• Works best in environments where DNS traffic is unrestricted.

Installation on Kali Linux

DNS2TCPd is pre-installed in Kali Linux. If not, install it via:

sudo apt update
sudo apt install dns2tcp

Verify installation:

dns2tcps -h

Basic Usage

Server Setup (dns2tcpd)

Start the server on a machine with a public IP or a DNS domain:

dns2tcpd -F -d 1 -f /etc/dns2tcpd.conf

• -F: Run in foreground.
• -d 1: Debug level 1 (verbose).
• -f: Configuration file.

Example Config (/etc/dns2tcpd.conf)

listen = 0.0.0.0
port = 53
user = nobody
chroot = /tmp
domain = example.com
resources = ssh:127.0.0.1:22, smtp:127.0.0.1:25

• domain: The domain to which DNS queries are sent.
• resources: Maps service names to local ports.

Client Setup (dns2tcpc)

Connect from a restricted network:

dns2tcpc -z example.com -d 1 -l 8888 -r ssh

• -z: Domain of the DNS2TCPd server.
• -l 8888: Local port for forwarding.
• -r ssh: Remote service (as defined in server config).

Now, SSH via the tunnel:

ssh -p 8888 user@localhost

Advanced Usage

Using Encryption

DNS2TCP does not encrypt traffic by default. Use SSH over DNS2TCP for security:

dns2tcpc -z example.com -l 8888 -r ssh
ssh -p 8888 -C user@localhost

Running as a Daemon

Run the server in the background:

dns2tcpd -f /etc/dns2tcpd.conf -d 0

Custom DNS Records

Force a specific record type:

dns2tcpc -z example.com -t TXT -l 8080 -r http

Command-Line Options

Server (dns2tcpd)

Client (dns2tcpc)

Real-World Use Cases

1. Bypassing Firewalls: Access SSH, HTTP, or other services in restricted networks.
2. Exfiltrating Data: Covert data transfer where only DNS is allowed.
3. Penetration Testing: Test network restrictions during security assessments.
4. Censorship Circumvention: Evade DNS-based censorship in oppressive regimes.

Troubleshooting

Common Issues & Fixes

1. Server Not Responding

• Check if port 53 is open (netstat -tulnp | grep 53).
• Verify DNS resolution (dig @server example.com).

2. Permission Denied

• Run as root (sudo dns2tcpd ...).
• Ensure no other service (like systemd-resolved) is using port 53.

3. Slow Performance

• DNS has size limits; use compression (-C in SSH).
• Try different DNS record types (-t NULL).

4. Debugging

• Increase verbosity (-d 3).
• Check logs (/var/log/syslog).