While using a wireless network recently that implemented a captive gateway, I noticed that any third party DNS servers manually set would not allow the network to connect properly.

This would seem to have the advantage of being able to block sites via DNS and not have people bypass that block by using an alternative DNS server.

How would you implement this? So that if any DNS servers other than what would be obtained by DHCP are used, a proper network connection cannot be established?


What are your goals? I think your goal is to block sites by denying name resolution. If that is your goal, it won't work.

  1. Using IP addresses will still get to the sites.
  2. Using a local hosts file (/etc/hosts) avoids the DNS protocol while providing for a limited subset of name resolution.
  3. Running a local DNS server on the host, but tunneling DNS requests hides the requests from your network.

A much easier alternative to your scheme that still suffers the same weaknesses as above is to block port 53 from traversing your firewall, or inspecting packets and blocking any DNS traffic across the firewall that doesn't come from your DNS server.

a proper network connection cannot be established

I'm not sure what you mean by this. By the time you detect the host using a different DNS server, a network connection will have already been established.

| improve this answer | |
  • I was mainly intrigued by the network I tried to join that would not establish an internet connection unless I was using the DNS servers assigned by DHCP. With my own 3rd party DNS servers set, I could not contact the outside world at all, even by IP address. I wondered what security advantages such a setup may have, and how it was implemented. – Sonny Ordell Oct 28 '11 at 19:53
  • That could be a side-effect of their authorization scheme. For example, if you are proxied through "their.host", your DNS server won't know how to reach the local proxy. Next time, leave your DNS server alone, but use dnslookup with server "" – Bradley Kreider Oct 28 '11 at 19:58

You could block all DNS requests except those to and from the DNS servers specified in DHCP by blocking port 53 on external connections.

Further you could relate those requests to a particular IP and revoke the DHCP lease.

Of course, this wouldn't stop someone from using a HOSTS file. It also wouldn't stop someone if they had a DNS server locally.

| improve this answer | |

Captive portals on wireless networks usually block all connections (including DNS) to other hosts before the client machine is authenticated. This to prevent IP-over-DNS tunneling (which would allow Internet access without being authenticated).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.