DNS Manipulation via IPTables or other means?
|
View:
New views
8 Messages
—
Rating Filter:
Alert me
|
 |
DNS Manipulation via IPTables or other means?
by Dan Bogda
::
Rate this Message:
Guys,
Sorry to cross post, but I'm looking to see if an IPTables solution exists for NATing DNS responses? I thought I could alter DNS responses with IPTables, but I can't find any reference to this. Does this functionality exist natively or via a plug in module? Otherwise, does anyone have any other suggestions? I have details of the problem below. I am looking for a network based solution so that the hosts don't need to be updated. I only need to update a handful of IP addresses and would like to focus there. I am currently running multiple views inside of BIND to provide an internal and external copy of each zone file, however this is not scalable. Thanks, Dan -----Original Message----- From: listbounce@... [mailto:listbounce@...] On Behalf Of Dan Bogda Sent: Thursday, November 02, 2006 9:25 PM To: security-basics@... Subject: DNS Manipulation Guys, I have segmented security zones that need to access the same devices, but via different NAT addresses. I am looking to manipulate the DNS responses from my BIND server and ideally I only want to affect DNS responses that contain the handful of addresses I am NAT'ing. I first started building this out with multiple views within BIND with a script to do conversion from the external to internal view, based on my list of NAT'd IPs, but as time progresses this doesn't seem too scalable. I am also unable to do the conversion on my firewalls due to the placement of the NAT operation. Ideally, I need a solution I can implement on my DNS server and I can control with access-lists or source filtering. I had considered running multiple instances of BIND, bound to separate IPs/Ports, but I would prefer to find a simpler solution if I can. I thought there was an IPTables module I can load to manipulate DNS response data, but I haven't been able to find any reference of it yet. Here's where I need your help: 1. Does a DNS, binary or other module exist for IPTables to manipulate DNS response data? 2. Has anyone done something similar and would like to share their solution? 3. Does anyone have any other suggestions, approaches I haven't considered? Thanks in advance! Dan ------------------------------------------------------------------------ --- This list is sponsored by: Norwich University EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The NSA has designated Norwich University a center of Academic Excellence in Information Security. Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Using interactive e-Learning technology, you can earn this esteemed degree, without disrupting your career or home life. http://www.msia.norwich.edu/secfocus ------------------------------------------------------------------------ --- |
|
|
Re: DNS Manipulation via IPTables or other means?
by Robert Hajime Lanning
::
Rate this Message:
No firewall product (IPTables or otherwise) has a DNS rewrite
feature. Infact, in the future, with DNSsec/Zone Signing, you will invalidate the response, if you change it. We handle this with the DNS Views with BIND, just like you are doing currently. For most of our externally facing applications, we have public routed IP addresses for our DMZ. But we still have the split views, so we still maintain seperate zones. Externally the zone consists of just external hosts/routers/firewalls.. Internally the zone consists of our internal hosts/routers/firewalls plus the external ones. So, while the internal zones have some 250k entries, the external one has hundreds. Also, what is the issue of allowing the internal hosts to access DMZ services via the NAT address? As long as the connection must pass through the firewall, the NAT should work fine. On 11/6/06, Dan Bogda <dan.bogda@...> wrote: > Guys, > Sorry to cross post, but I'm looking to see if an IPTables solution > exists for NATing DNS responses? I thought I could alter DNS responses > with IPTables, but I can't find any reference to this. Does this > functionality exist natively or via a plug in module? Otherwise, does > anyone have any other suggestions? > > I have details of the problem below. I am looking for a network based > solution so that the hosts don't need to be updated. I only need to > update a handful of IP addresses and would like to focus there. I am > currently running multiple views inside of BIND to provide an internal > and external copy of each zone file, however this is not scalable. > > Thanks, > Dan > > > -----Original Message----- > From: listbounce@... [mailto:listbounce@...] > On Behalf Of Dan Bogda > Sent: Thursday, November 02, 2006 9:25 PM > To: security-basics@... > Subject: DNS Manipulation > > Guys, > I have segmented security zones that need to access the same devices, > but via different NAT addresses. I am looking to manipulate the DNS > responses from my BIND server and ideally I only want to affect DNS > responses that contain the handful of addresses I am NAT'ing. I first > started building this out with multiple views within BIND with a script > to do conversion from the external to internal view, based on my list of > NAT'd IPs, but as time progresses this doesn't seem too scalable. I am > also unable to do the conversion on my firewalls due to the placement of > the NAT operation. > > Ideally, I need a solution I can implement on my DNS server and I can > control with access-lists or source filtering. I had considered running > multiple instances of BIND, bound to separate IPs/Ports, but I would > prefer to find a simpler solution if I can. I thought there was an > IPTables module I can load to manipulate DNS response data, but I > haven't been able to find any reference of it yet. > > Here's where I need your help: > > 1. Does a DNS, binary or other module exist for IPTables to manipulate > DNS response data? > > 2. Has anyone done something similar and would like to share their > solution? > > 3. Does anyone have any other suggestions, approaches I haven't > considered? > > > Thanks in advance! > Dan > > > ------------------------------------------------------------------------ > --- > This list is sponsored by: Norwich University > > EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE > The NSA has designated Norwich University a center of Academic > Excellence > in Information Security. Our program offers unparalleled Infosec > management > education and the case study affords you unmatched consulting > experience. > Using interactive e-Learning technology, you can earn this esteemed > degree, > without disrupting your career or home life. > > http://www.msia.norwich.edu/secfocus > ------------------------------------------------------------------------ > --- > > -- And, did Guloka think the Ulus were too ugly to save? -Centauri |
|
|
Re: DNS Manipulation via IPTables or other means?
by terry white
::
Rate this Message:
... ciao:
: on "11-6-2006" "Dan Bogda" writ: : IPTables NATing DNS responses? first, there is something about that, that just "feels" wrong. iptables, natively, does NAT. why involve BIND at all. as a given, i am not at all clear on the topology you are trying to manage, or what you are trying to accomplish. that may well explain not understanding 'how' you want to do it, so to speak ... -- ... i'm a man, but i can change, if i have to , i guess ... |
|
|
RE: DNS Manipulation via IPTables or other means?
by Fabrice Barutel
::
Rate this Message:
Hi,
If you have Cisco PIX, you should look at DNS Doctoring feature : it could help you. -- Fabrice Barutel -----Message d'origine----- De : listbounce@... [mailto:listbounce@...] De la part de Robert Hajime Lanning Envoyé : mardi 7 novembre 2006 01:15 À : firewalls@... Objet : Re: DNS Manipulation via IPTables or other means? No firewall product (IPTables or otherwise) has a DNS rewrite feature. Infact, in the future, with DNSsec/Zone Signing, you will invalidate the response, if you change it. We handle this with the DNS Views with BIND, just like you are doing currently. For most of our externally facing applications, we have public routed IP addresses for our DMZ. But we still have the split views, so we still maintain seperate zones. Externally the zone consists of just external hosts/routers/firewalls.. Internally the zone consists of our internal hosts/routers/firewalls plus the external ones. So, while the internal zones have some 250k entries, the external one has hundreds. Also, what is the issue of allowing the internal hosts to access DMZ services via the NAT address? As long as the connection must pass through the firewall, the NAT should work fine. On 11/6/06, Dan Bogda <dan.bogda@...> wrote: > Guys, > Sorry to cross post, but I'm looking to see if an IPTables solution > exists for NATing DNS responses? I thought I could alter DNS responses > with IPTables, but I can't find any reference to this. Does this > functionality exist natively or via a plug in module? Otherwise, does > anyone have any other suggestions? > > I have details of the problem below. I am looking for a network based > solution so that the hosts don't need to be updated. I only need to > update a handful of IP addresses and would like to focus there. I am > currently running multiple views inside of BIND to provide an internal > and external copy of each zone file, however this is not scalable. > > Thanks, > Dan > > > -----Original Message----- > From: listbounce@... [mailto:listbounce@...] > On Behalf Of Dan Bogda > Sent: Thursday, November 02, 2006 9:25 PM > To: security-basics@... > Subject: DNS Manipulation > > Guys, > I have segmented security zones that need to access the same devices, > but via different NAT addresses. I am looking to manipulate the DNS > responses from my BIND server and ideally I only want to affect DNS > responses that contain the handful of addresses I am NAT'ing. I first > started building this out with multiple views within BIND with a script > to do conversion from the external to internal view, based on my list of > NAT'd IPs, but as time progresses this doesn't seem too scalable. I am > also unable to do the conversion on my firewalls due to the placement of > the NAT operation. > > Ideally, I need a solution I can implement on my DNS server and I can > control with access-lists or source filtering. I had considered running > multiple instances of BIND, bound to separate IPs/Ports, but I would > prefer to find a simpler solution if I can. I thought there was an > IPTables module I can load to manipulate DNS response data, but I > haven't been able to find any reference of it yet. > > Here's where I need your help: > > 1. Does a DNS, binary or other module exist for IPTables to manipulate > DNS response data? > > 2. Has anyone done something similar and would like to share their > solution? > > 3. Does anyone have any other suggestions, approaches I haven't > considered? > > > Thanks in advance! > Dan > > > ------------------------------------------------------------------------ > --- > This list is sponsored by: Norwich University > > EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE > The NSA has designated Norwich University a center of Academic > Excellence > in Information Security. Our program offers unparalleled Infosec > management > education and the case study affords you unmatched consulting > experience. > Using interactive e-Learning technology, you can earn this esteemed > degree, > without disrupting your career or home life. > > http://www.msia.norwich.edu/secfocus > ------------------------------------------------------------------------ > --- > > -- And, did Guloka think the Ulus were too ugly to save? -Centauri |
|
|
|
|
|
Re: DNS Manipulation via IPTables or other means?
by Florian Rommel
::
Rate this Message:
honestly , I have worked with iptables in really complex environments for many years, i never have heard of manipulating dns records on the fly, I don't even think you can do this with string matching since string matching lets you check for a string, not manipulate it. I really wonder why views aren't scalable, maybe there is another solution, I always draw my stuff out on paper (yes REAL paper :)) and visualize it that way, then find easier solution by looking at the picture. Views in Bind are meant for this kind of thing , different access control from different ips give you different results. Would you mind sharing some more info? maybe the amount of views you are handling etc. Maybe someone comes up with a more streamlined idea? cheers sorry, just my 2 cents //Flosse http://blog.2blocksaway.com |
|
|
Re: DNS Manipulation via IPTables or other means?
by Patrick Debois
::
Rate this Message:
You might use the BIND view functionality
http://www.zytrax.com/books/dns/ch7/view.html Arthur Fonzarelli wrote: > Hmm. Not sure about iptables. I nwhat way is BIND not scalable -- > have you tried > djbdns ? it has a similar feature that allows for wildcarding and > catchalls -- its also much more > secure than BIND > > On 11/6/06, Dan Bogda <dan.bogda@...> wrote: >> Guys, >> Sorry to cross post, but I'm looking to see if an IPTables solution >> exists for NATing DNS responses? I thought I could alter DNS responses >> with IPTables, but I can't find any reference to this. Does this >> functionality exist natively or via a plug in module? Otherwise, does >> anyone have any other suggestions? >> >> I have details of the problem below. I am looking for a network based >> solution so that the hosts don't need to be updated. I only need to >> update a handful of IP addresses and would like to focus there. I am >> currently running multiple views inside of BIND to provide an internal >> and external copy of each zone file, however this is not scalable. >> >> Thanks, >> Dan >> >> >> -----Original Message----- >> From: listbounce@... [mailto:listbounce@...] >> On Behalf Of Dan Bogda >> Sent: Thursday, November 02, 2006 9:25 PM >> To: security-basics@... >> Subject: DNS Manipulation >> >> Guys, >> I have segmented security zones that need to access the same devices, >> but via different NAT addresses. I am looking to manipulate the DNS >> responses from my BIND server and ideally I only want to affect DNS >> responses that contain the handful of addresses I am NAT'ing. I first >> started building this out with multiple views within BIND with a script >> to do conversion from the external to internal view, based on my list of >> NAT'd IPs, but as time progresses this doesn't seem too scalable. I am >> also unable to do the conversion on my firewalls due to the placement of >> the NAT operation. >> >> Ideally, I need a solution I can implement on my DNS server and I can >> control with access-lists or source filtering. I had considered running >> multiple instances of BIND, bound to separate IPs/Ports, but I would >> prefer to find a simpler solution if I can. I thought there was an >> IPTables module I can load to manipulate DNS response data, but I >> haven't been able to find any reference of it yet. >> >> Here's where I need your help: >> >> 1. Does a DNS, binary or other module exist for IPTables to manipulate >> DNS response data? >> >> 2. Has anyone done something similar and would like to share their >> solution? >> >> 3. Does anyone have any other suggestions, approaches I haven't >> considered? >> >> >> Thanks in advance! >> Dan >> >> >> ------------------------------------------------------------------------ >> --- >> This list is sponsored by: Norwich University >> >> EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE >> The NSA has designated Norwich University a center of Academic >> Excellence >> in Information Security. Our program offers unparalleled Infosec >> management >> education and the case study affords you unmatched consulting >> experience. >> Using interactive e-Learning technology, you can earn this esteemed >> degree, >> without disrupting your career or home life. >> >> http://www.msia.norwich.edu/secfocus >> ------------------------------------------------------------------------ >> --- >> >> >> --------------------------------------------------------------------------- >> >> This list is sponsored by: Norwich University >> >> EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE >> The NSA has designated Norwich University a center of Academic >> Excellence >> in Information Security. Our program offers unparalleled Infosec >> management >> education and the case study affords you unmatched consulting >> experience. >> Using interactive e-Learning technology, you can earn this esteemed >> degree, >> without disrupting your career or home life. >> >> http://www.msia.norwich.edu/secfocus >> --------------------------------------------------------------------------- >> >> >> > > --------------------------------------------------------------------------- > > This list is sponsored by: Norwich University > > EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE > The NSA has designated Norwich University a center of Academic > Excellence in Information Security. Our program offers unparalleled > Infosec management education and the case study affords you unmatched > consulting experience. Using interactive e-Learning technology, you > can earn this esteemed degree, without disrupting your career or home > life. > > http://www.msia.norwich.edu/secfocus > --------------------------------------------------------------------------- > > |
|
|
RE: DNS Manipulation via IPTables or other means?
by Paul Ryland
::
Rate this Message:
> honestly , I have worked with iptables in really complex > environments for many years, i never have heard of > manipulating dns records on the fly, I don't even think you > can do this with string matching since string matching lets > you check for a string, not manipulate it. > > I really wonder why views aren't scalable, maybe there is > another solution, I always draw my stuff out on paper (yes > REAL paper :)) and visualize it that way, then find easier > solution by looking at the picture. Views in Bind are meant > for this kind of thing , different access control from > different ips give you different results. Would you mind > sharing some more info? maybe the amount of views you are > handling etc. Maybe someone comes up with a more streamlined idea? Consider this example, your company wants to provide access to a partner company over an IPSec VPN connection. The servers at both companies are on the same 192.168.1.0/24 network. Your company wants to also forward DNS requests to your partner company's DNS server for lookups involving their internal DNS domain. There are several points worth noting about this setup: i) NAT will have to be used to prevent the two internal networks colliding ii) your partner company's DNS server will be returning addresses on your own network, not on the remote NAT'ed network. ii) you might not be able to request views on your partner company's DNS server iii) it is not a scalable and maintainable solution to provide spoofed zones for your partner company's DNS zones. An ideal solution (as provided by the PIX) is to manipulate the DNS responses from your partner company's DNS server. I've never even bothered trying to set-up a deployment, with these issues, with IPTables --- any pointers as to how to do this with IPTables would be greatly appreciated. Paul |
| Free embeddable forum powered by Nabble | Forum Help |
