Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm looking for a way to log DNS queries using iptables for vpn users.

What I'm looking for is to record in the syslog the source IP, the Record type and the domain name for new DNS queries.

I've had a look at http://software.klolik.org/xt_dns/ but that doesn't seem to be able to log the actual lookup name used in the query.

Any ideas?

share|improve this question
1  
Does it absolutely have to be iptables? It seems like using a wrong tool for the job. Maybe you're better off with using some sort of traffic analyzer? –  dusty Jun 18 '13 at 15:55
    
no, not at all, it could be another tool as long as its not too heavy.. I already have a custom netfilter module running so I was thinking of writing some code in there but if there are any solutions that already exist it would save me the time –  user1167223 Jun 18 '13 at 16:09

1 Answer 1

up vote 4 down vote accepted

It sounds like you want some sort of pdns tool. For example this genious one: https://github.com/gamelinux/passivedns It is very lightweight, and runs by listening on the traffic on your interface.

It will log DNS requests like this:

1371572390.617141||195.225.XX.YYY||208.78.71.16||IN||github.com.||A||204.232.175.90||300||1 

The format here is:

timestamp||dns-client ||dns-server||RR class||Query||Query Type||Answer||TTL||Count
share|improve this answer
    
looks very interesting.. because it is looking at the interface I presume it does not need the DNS server on the box? for example if my VPN clients use 8.8.8.8 for their DNS I can still log the lookups going through? –  user1167223 Jun 18 '13 at 16:34
    
In theory, yes. Although I have not tested that myself. –  espenfjo Jun 18 '13 at 17:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.