0

With the recent UK news on the snoopers charter ISP's will be able to log and store a users Internet activities for up to a year and be made available to the Government. I've started thinking about solutions to stop an ISP tracking activity but I'm not sure if it's possible.

To my knowledge regardless of whether a user is using end-to-end encryption the ISP will still be able to see the source and destination addresses in the IP packet.

Is there any way to stop this?

My initial thought was to use SSH to create a tunnel that all Internet traffic goes through from a specific machine. In fact, if should be possible to this on a router.

But, would a DNS request still be made or is the entire request sent to the server that's tunnelling the request? Would the server take care of resolving the DNS, fetching the data, and sending it back?

An example of setting up a quick SOCKS5 tunnel for simplicities sake:

ssh -D1337 unpriv_user@example.com

Can DNS be tunnelled through that too?

Improve this question
1

This depends on the kind of tunnel:

  • If you just do a port forwarding then all DNS requests will be done by your local machine against the configured DNS server and thus be visible by the ISP.
  • If you configure an explicit HTTP proxy in your browser and you tunnel access to this proxy through SSH then the DNS resolving will be done by the proxy, i.e. at the other end of the SSH tunnel.
  • If you use SSH as a SOCKS server then it depends on the SOCKS version in use. With SOCKS4 DNS lookups will be done locally. With SOCKS5 they might be done local or at the other end of the tunnel, depending on the capabilities and settings inside the browser.
  • With applications which are not aware of the proxy (i.e. use of socksify or similar) DNS lookups will be done locally (i.e. visible by the ISP).

A safer way would be to use a real VPN instead of a proxy since this way all network traffic independent of the applications configuration can be tunneled, including DNS lookups. But note that VPN is often misconfigured so that DNS lookups or IPv6 connections bypass the VPN.

Improve this answer
3
  • I've edited the question to show an example. I was thinking about using a SOCKS5. On my Mac I do something like this with ProxyCap: www.proxycap.com. – BugHunterUK Dec 4 '16 at 12:43
  • @BugHunterUK: Applications which are not aware that a proxy is used will not use DNS through the proxy. I'm not sure exactly how ProxyCap works but if it only configures a proxy aware application then DNS lookup will probably done through the proxy. If it instead overrides socket connect of proxy unaware applications then I'm pretty sure that DNS lookup will not be done through the proxy. – Steffen Ullrich Dec 4 '16 at 12:55
  • Ah, I wasn't aware DNS lookups went through a VPN. I will look into setting up a VPN server and do some research into this. – BugHunterUK Dec 4 '16 at 13:13
0

It depends on the configuration. SOCKS5 supports also tunneling of DNS. But it will only move the problem further. If your home ISP will not see the DNS queries, the ISP of your server will see them.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.