1

Alright, my situation is basically this... I have a box that's acting as a router, with 2 interfaces, eth0 and eth1. eth1 is my uplink, that is it is the interface through which the box is obtaining an Internet connection. eth0 is the downlink, that is the interface through which another device / a switch / a wireless AP / what have you would be connected.

I want to somehow, with iptables, make it so that all requests to port 53 any address that are originating at eth0 should instead be sent to the DNS server running at 127.0.0.1, and when that DNS server sends a reply, the machine that sent the request should have it seem like the reply came from the address they actually sent the packet to.

Example, say there is a machine connected to eth0 configured to use 8.8.8.8 as the DNS server. The routing machine's DNS server has a record for example.com pointing at 192.0.2.1. Someone on the machine connected to eth0 runs dig example.com @8.8.8.8. They get a reply that APPEARS to come from 8.8.8.8, but ACTUALLY came from the routing box, and this reply says that the A record for example.com is 192.0.2.1.

How can I do this?

Note that this needs to work for ANY DNS server address, not just 8.8.8.8.

1 Answer 1

0

You need specific software to perform this, and it is considered Evil. Breaking the Internet by performing a man-in-the-middle attack on DNS traffic is exactly why things like DNSSec are being rolled out.

If you're intent on looking though, you might want to check results for "DNS Interception" and "Transparent DNS Proxy". Some things that come to mind are Barracuda firewalls, dnschef, and perhaps a variety of web filtering suites offer this feature.

4
  • I need to perform a MITM like this because this box will be acting as a wireless hotspot, and I want people to be redirected to my captive portal to login when they try to go to a website for the first time, no matter what site they tried to visit.
    – AppleDash
    Apr 30, 2015 at 20:08
  • That is done typically by redirecting traffic to web ports (80 & 443) to your sign in page rather than by spoofing DNS
    – HBruijn
    May 1, 2015 at 4:31
  • @HBruijn I'd rather spoof DNS though, it seems a lot easier.
    – AppleDash
    May 1, 2015 at 23:57
  • @appledash Until they want to visit the site after they log in and the site they originally wanted still has your site in DNS cache
    – Hyppy
    May 2, 2015 at 0:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .