2

While using a wireless network recently that implemented a captive gateway, I noticed that any third party DNS servers manually set would not allow the network to connect properly.

This would seem to have the advantage of being able to block sites via DNS and not have people bypass that block by using an alternative DNS server.

How would you implement this? So that if any DNS servers other than what would be obtained by DHCP are used, a proper network connection cannot be established?

3 Answers 3

4

What are your goals? I think your goal is to block sites by denying name resolution. If that is your goal, it won't work.

  1. Using IP addresses will still get to the sites.
  2. Using a local hosts file (/etc/hosts) avoids the DNS protocol while providing for a limited subset of name resolution.
  3. Running a local DNS server on the host, but tunneling DNS requests hides the requests from your network.

A much easier alternative to your scheme that still suffers the same weaknesses as above is to block port 53 from traversing your firewall, or inspecting packets and blocking any DNS traffic across the firewall that doesn't come from your DNS server.

a proper network connection cannot be established

I'm not sure what you mean by this. By the time you detect the host using a different DNS server, a network connection will have already been established.

2
  • I was mainly intrigued by the network I tried to join that would not establish an internet connection unless I was using the DNS servers assigned by DHCP. With my own 3rd party DNS servers set, I could not contact the outside world at all, even by IP address. I wondered what security advantages such a setup may have, and how it was implemented. Oct 28, 2011 at 19:53
  • That could be a side-effect of their authorization scheme. For example, if you are proxied through "their.host", your DNS server won't know how to reach the local proxy. Next time, leave your DNS server alone, but use dnslookup with server "8.8.8.8" Oct 28, 2011 at 19:58
2

You could block all DNS requests except those to and from the DNS servers specified in DHCP by blocking port 53 on external connections.

Further you could relate those requests to a particular IP and revoke the DHCP lease.

Of course, this wouldn't stop someone from using a HOSTS file. It also wouldn't stop someone if they had a DNS server locally.

0

Captive portals on wireless networks usually block all connections (including DNS) to other hosts before the client machine is authenticated. This to prevent IP-over-DNS tunneling (which would allow Internet access without being authenticated).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .