16

I have iptables blocking all UDP traffic at the moment, however I want to allow only certain DNS queries to get through.

Let's use google.com as an example.

I am trying to use string matching to find the domain name in the request, and allow it. This is what I came up with.

iptables -A OUTPUT -o eth0 -p udp --sport 53 -m string --string "google.com" --algo bm -j ACCEPT

I have also tried --dport 53 instead of --sport. No dice.

If anyone knows how this can be done or see's where I went wrong your help is appreciated!

Thanks, Jarred

Improve this question

2 Answers 2

Reset to default
28

I know this is a bit late, but since you haven't closed the question...

If you look at the contents of the DNS request packet in wireshark or similar you will find that the dot character is not used. Each part of the domain name is a counted string, so the actual bytes of the request for google.com will be:

06 67 6f 6f 67 6c 65 03 63 6f 6d

The first byte (06) is the length of google, followed by the 6 ASCII characters, then a count byte (03) for the length of com followed by... you get the idea.

To match this in iptables, use the following:

iptables -A OUTPUT -o eth0 -p udp --port 53 -m string --hex-string "|06|google|03|com" -algo bm -j ACCEPT

The --hex-string parameter parses the provided string looking for hex values delimited by pairs of vertical bars. Anything outside of the vertical bars is interpreted as ASCII text.

If you list the OUTPUT table after adding the entry you'll find something along the lines of:

ACCEPT udp -- anywhere anywhere udp dpt:domain STRING match "|06676f6f676c6503636f6d|" ALGO name bm TO 65535

You can tune the rule slightly - and speed it up - by restricting the search range using the --from and --to parameters.

Improve this answer
Sign up to request clarification or add additional context in comments.

8 Comments

Awesome man, You saved a lot of time. Though It took time to verify this.
why algo type is bm (Boyer-Moore) ?
@GauravKansal From memory it was the one used in all the examples I could find at the time I was doing this. The other option is Knuth-Morris-Pratt, which isn't necessarily faster than Boyer-Moore in this context, and may have slightly higher overheads. I can't confirm this as I haven't done any testing.
This answer is great and I adopted it happily! However, it should be pointed out, that technically it is possible to craft DNS queries with multiple questions, allowing someone to resolve arbitrary hosts as long as the allowed host is also in the questions section of the DNS query. Support for DNS queries with multiple questions is rare, though.
@Corey If the rule would reject requests for a certain domain, yes. But the original task (and mine) was to only allow certain hosts. If you then craft a multi-DNS query with at least one allowed host in the questions section, you will be able to query any host by adding it to the questions section.
|
4

I found that is not reliable with strings with dots.

This will work:

iptables -A OUTPUT -o eth0 -p udp --port 53 -m string --string google --algo bm -j ACCEPT
Improve this answer

1 Comment

Can you provide an example where it doesn't work with strings with dots?

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.