3

Overview:

I have software that has our Edge/DNS servers hardcoded into them, DNS queries returned from DNS servers are not being masked properly. I need the DNS entries that are returned from BIND query requests to be masked with the originating server that has requested the query and not the DNS servers IP. The reason for why I want the masking is so that if an attacker were to get ahold of one of my edge server IP's and DDoS it, they would not be able to get ahold of the other servers IPs and DDoS or attack them as well.

The diagram below illustrates a simple version of what I'm trying to accomplish.

There are two types of ways the users can connect:

  • Directly to the edge server IP that is provided to them/hardcoded in

OR

  • Directly connect to their edge server assigned, and then via a web interface they select which office/server to connect to which on the backend does a iptables REDIRECT on their edge server which goes over a VPN tunnel.

Problem:

Sequence of events:

  1. User2 connects to their edge server(server2)
  2. edge server2 redirects their query to edge server1
  3. edge server1 returns back to edge server2 the query response with edge server1's IP embedded in the DNS packet.
  4. User gets hidden edge server IP that they should not know of.

Core problem:

Edge server's IP is embedded in the DNS response packet and needs to be masked to the original edge servers IP that the User is connected to

Problem

DNS Lookup example output:

  • User2 queries for google.ca
  • DNS Server1 processes the query and returns the result of it's own IP and not google's IP.

Lookup request(wrong):

nslookup google.ca
Server:  UnKnown
Address:  2.2.2.2
Name:    google.ca
Address:  1.1.1.1

Lookup Request that should be showing:

nslookup google.ca
Server:  UnKnown
Address:  2.2.2.2
Name:    google.ca
Address:  2.2.2.2

Below is a large scaled version of the network/system that is built.

Offices can have one or more servers in them depending on how many users.

(This is just illustrated to give you an idea of how it needs to scale)

Infrastructure

What I've tried:

  • iptables pre/post routing(didn't mask)
  • Played with BIND configuration(altered the db.override file to return the servers IP) which worked but would require an individual server per edge server due to this file not being able to be real-time updated.

Potential Solutions Theory:

  • Layer 7 solution that can alter the DNS query results IP, whether its a firewall or a sniffer/injection script that forces particular queries to show the original edge servers IP.
  • 1
    Is there some reason why you can't just run a DNS server on the box, and then to a simple iptables REDIRECT 53 so that the running DNS server handles everything? Then just configure DNS server to serve whatever records you like. – Zoredache Oct 7 '14 at 19:24
  • the redirect on server1 is what we currently use. However when the response is returned from server2's DNS server, it shows the server2's IP when we require it to show server1's IP as we don't want the internal IP to be disclosed. – RCG Oct 7 '14 at 19:26
  • 2
    You really need to spend more time describing what your actual problem is. Instead of trying to focus on asking us to recommend some product as a solution. Plus you have given us a weird set of requirements. What exactly is a my own custom linux setup? Almost all general purpose distros are heavily customizable. Popular Server distros include Centos,Redhat,Debian,UbuntuServer... – Zoredache Oct 7 '14 at 19:35
  • 2
    So I looked at the deleted question Iain linked to, and combined that with what you have written here and I still can't follow what is going on. This is the time where I think a picture would be worth a thousand words. A good network diagram combined with a good combined with really good labeling. At the moment you your abstraction and obfuscation of the details in both the previous question and this one make it very hard to follow. – Zoredache Oct 7 '14 at 20:44
  • 1
    This is investing far too much effort into solving a perceived problem in an overly convoluted way. Your contingencies must be designed around the assumption that knowledge of the DNS server IPs will be leaked. Smoke and mirrors will not save you. (yes, I know the linked question is different, but the answer is the same) – Andrew B Oct 8 '14 at 4:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.