Skip to content
This repository has been archived by the owner on Jun 4, 2021. It is now read-only.

Feature request: ICMP/DNS tunnels #26

Closed
kyhwana opened this issue Jul 26, 2014 · 10 comments
Closed

Feature request: ICMP/DNS tunnels #26

kyhwana opened this issue Jul 26, 2014 · 10 comments

Comments

@kyhwana
Copy link

kyhwana commented Jul 26, 2014

DNS/ICMP tunneling would be nice, especially to get around networks that shape/block things like SSH/OpenVPN, etc but allow outoging ICMP and/or DNS.
@jlund
Copy link
Member

jlund commented Jul 26, 2014

I haven't tried this before. In general, it sounds like the performance of this type of tunnelling is very, very slow. Do you have any suggestions for the best available daemons that support this? I will take a closer look.

@kyhwana
Copy link
Author

kyhwana commented Jul 27, 2014

I've used http://thomer.com/icmptx/ before, apparently http://code.gerade.org/hans/ has some more features.

For DNS tunnelling, that would require more setup, I guess. I've used iodine in the past and it worked, though it was slow. (So OK for SSH/IRC/etc. Not for watching youtube :|)
http://code.kryo.se/iodine/

@ddworken
Copy link

One thing to keep in mind is that for iodine (and other DNS tunneling solutions) one needs to have a domain name that they can configure for use with it. I would personally be willing to "donate" my domain name: tcp-dns.com (I got it for this exact use earlier) for this purpose if anyone has any suggestions of a DNS provider that has easily scriptable access to DNS records (2 DNS records need to be generated per client).

I also think that this would be a good solution as DNS tunneling is one of the few truly foolproof methods of tunneling out of a hostile/filtered network.

@psifertex
Copy link

I've used iodine before to great effect. It's main use is in captive portals that pass DNS, but it's also useful as YetAnotherProtectedCommsChannel which seems to be the main goal of Streisand.

At the start at least users could bring their own domains (it's not super-hard to setup the single NS record needed on an existing domain or sub-domain) and then all the configuration just requires the domain name being used.

@ddworken
Copy link

Personally, I feel like one of the main advantages to Streisand is that it automatically sets up a variety of services without significant user interaction. Forcing the user to either have their own domain name or disable a service seems to go against this idea. I just am not sure if there is any simple way to script adding DNS records though.

@psifertex
Copy link

Depends on the provider. If you've got amazon managing a domain name, then scripting up ns records is indeed possible. In fact, you could even check and see if they have any domains, ask them if they want to use one, and then make a random subdomain to run off of which requires no effort on their part.

That still is some interaction though which I realize isn't the point of streisand, so it might not be integrated. Maybe that can be one of those power-user command-line switches that people can enable.

@ddworken
Copy link

Right now the domain is registered with Dyn. I'll look into switching providers if you guys think TCP over DNS would be a good feature to implement.

@jlund
Copy link
Member

jlund commented Jul 31, 2014

I finally had some time tonight to look into Hans, ICMPTX, and iodine. I am very impressed with how clever these solutions are (abusing ping and DNS requests to route traffic is pretty rad). However, they all have a fatal flaw: none of them are encrypted.

Given some of the areas where I'm hoping Streisand will be used, like China and Iran, this is an absolute deal-breaker. All of the other services that Streisand sets up are encrypted, and I consider this to be a critical feature. While it's possible to double-tunnel encrypted traffic over the tunnels that Hans, ICMPTX, and iodine establish, this would be even slower than their default configuration. Given how well OpenSSH, OpenVPN (wrapped in stunnel), Shadowsocks, and Tor (with the obfs3 and ScrambleSuit pluggable transports) are working in China right now, I don't think it's necessary to make this leap quite yet.

I can look into making a separate Ansible playbook to automate the setup of iodine or one of these other tools, but the lack of encryption across the board, and domain name requirements for iodine in particular, make me feel like they aren't an ideal fit for Streisand right now.

@jlund jlund closed this as completed Jul 31, 2014
@ddworken
Copy link

One thing that I think you may have missed: Iodine works by forwarding a port on the local machine (e.g. 60022) to a port on the server (e.g. 22). From there, one simply uses sshuttle or any other proxy that is available on the server (on the port you set it to). This means you could for example set up Iodine to forward the port to connect to OpenVPN. This means that the traffic will be encrypted (and there is no way to send unencrypted traffic).

@jlund
Copy link
Member

jlund commented Jul 31, 2014

Yeah, this is the "double tunnel" approach I was referring to. Performance was pretty bad (bordering on unusable sometimes) in my testing. I dislike the domain requirement too, even though I agree that portions of it could be mostly worked around.

On July 31, 2014 7:48:10 AM MDT, David Dworken [email protected] wrote:

One thing that I think you may have missed: Iodine works by forwarding
a port on the local machine (e.g. 60022) to a port on the server (e.g.
22). From there, one simply uses sshuttle or any other proxy that is
available on the server (on the port you set it to). This means you
could for example set up Iodine to forward the port to connect to
OpenVPN. This means that the traffic will be encrypted (and there is no
way to send unencrypted traffic).

Reply to this email directly or view it on GitHub:
#26 (comment)

@ddworken ddworken mentioned this issue Aug 7, 2014
Closed
alimakki added a commit to alimakki/streisand that referenced this issue Apr 29, 2017
@alimakki
# This is a combination of 129 commits.
023ebef 
# This is the 1st commit message:
initial fr commit

# This is the commit message StreisandEffect#2:

readme completed

# This is the commit message StreisandEffect#3:

corrections

# This is the commit message StreisandEffect#4:

readme done

# This is the commit message StreisandEffect#5:

readme even more done

# This is the commit message StreisandEffect#6:

more corrections

# This is the commit message StreisandEffect#7:

initial commit for translated instructions

# This is the commit message StreisandEffect#8:

fixed typos

# This is the commit message StreisandEffect#9:

fixed markdown

# This is the commit message StreisandEffect#10:

fixed anchor

# This is the commit message StreisandEffect#11:

grammar and typos

# This is the commit message StreisandEffect#12:

fixed markdown

# This is the commit message StreisandEffect#13:

finished french instructions for windows l2tp/ipsec

# This is the commit message StreisandEffect#14:

androïde

# This is the commit message StreisandEffect#15:

finished osx instructions for l2tp/ipsec

# This is the commit message StreisandEffect#16:

finished linux l2tp/ipsec

# This is the commit message StreisandEffect#17:

finished ios l2tp/ipsec

# This is the commit message StreisandEffect#18:

common entries in l2tp translated

# This is the commit message StreisandEffect#19:

minor corrections

# This is the commit message StreisandEffect#20:

android l2tp/ipsec translations done

# This is the commit message StreisandEffect#21:

l2tp/ipsec french done

# This is the commit message StreisandEffect#22:

typos

# This is the commit message StreisandEffect#23:

initial commit for openconnect

# This is the commit message StreisandEffect#24:

partial windows instructions completed

# This is the commit message StreisandEffect#25:

removed idea files

# This is the commit message StreisandEffect#26:

renamed readme_fr to readme-fr

# This is the commit message StreisandEffect#27:

windows oc instructions done

# This is the commit message StreisandEffect#28:

finished osx instructions, updated brew url to https

# This is the commit message StreisandEffect#29:

oc linux instructions done, minor corrections

# This is the commit message StreisandEffect#30:

stuff

# This is the commit message StreisandEffect#31:

oc instructions french done

# This is the commit message StreisandEffect#32:

minor correction

# This is the commit message StreisandEffect#33:

initial commit for openvpn instructions fr

# This is the commit message StreisandEffect#34:

finished windows ovpn instructions

# This is the commit message StreisandEffect#35:

copypasta the common stuff

# This is the commit message StreisandEffect#36:

typos

# This is the commit message StreisandEffect#37:

removed azure from upcoming features fr

# This is the commit message StreisandEffect#38:

updated azure Readme-fr.md

# This is the commit message StreisandEffect#39:

Silence la censure. Automatiser l'effet

# This is the commit message StreisandEffect#40:

minor corrections

# This is the commit message StreisandEffect#41:

minor corrections

# This is the commit message StreisandEffect#42:

more translations

# This is the commit message StreisandEffect#43:

finished macos ovpn instructions

# This is the commit message StreisandEffect#44:

eeeeeeeeee

# This is the commit message StreisandEffect#45:

openvpn linux cli done

# This is the commit message StreisandEffect#46:

finish linux ovpn network manager

# This is the commit message StreisandEffect#47:

ovpn android done

# This is the commit message StreisandEffect#48:

finished ovpn ios instructions

# This is the commit message StreisandEffect#49:

minor correction

# This is the commit message StreisandEffect#50:

initial commit for shadowsocks-fr

# This is the commit message StreisandEffect#51:

windows shadowsocks done

# This is the commit message StreisandEffect#52:

shadowsocks macos done

# This is the commit message StreisandEffect#53:

really macos is done

# This is the commit message StreisandEffect#54:

commit before merge

# This is the commit message StreisandEffect#55:

finished ff shadowsocks instructions

# This is the commit message StreisandEffect#56:

shadowsocks done

# This is the commit message StreisandEffect#57:

initial commit for wg fr

# This is the commit message StreisandEffect#58:

initial commit for ssh fr

# This is the commit message StreisandEffect#59:

windows ssh instructions done

# This is the commit message StreisandEffect#60:

linux-osx ssh done

# This is the commit message StreisandEffect#61:

linux osx alternative ssh done

# This is the commit message StreisandEffect#62:

android almost done

# This is the commit message StreisandEffect#63:

finished instructions for shadowsocks

# This is the commit message StreisandEffect#64:

mirror index fr done

# This is the commit message StreisandEffect#65:

tunnel ssh

# This is the commit message StreisandEffect#66:

progress for streisang-gateway fr

# This is the commit message StreisandEffect#67:

finished windows gateway instructions

# This is the commit message StreisandEffect#68:

manual ssl verification done

# This is the commit message StreisandEffect#69:

one more line

# This is the commit message StreisandEffect#70:

finished osx android gateway fr

# This is the commit message StreisandEffect#71:

ios gateway done

# This is the commit message StreisandEffect#72:

finished all of gateway instructions fr

# This is the commit message StreisandEffect#73:

initial commit for tor-fr

# This is the commit message StreisandEffect#74:

tor done

# This is the commit message StreisandEffect#75:

initial commit for azure-fr.md

# This is the commit message StreisandEffect#76:

azure-fr done

# This is the commit message StreisandEffect#77:

preparing to link it all up

# This is the commit message StreisandEffect#78:

working on i18n generation

# This is the commit message StreisandEffect#79:

Streisand CI Testing

# This is the commit message StreisandEffect#80:

attempt i18n..

# This is the commit message StreisandEffect#81:

removed commented stuff

# This is the commit message StreisandEffect#82:

fixed lang loop in md templates

# This is the commit message StreisandEffect#83:

spelling

# This is the commit message StreisandEffect#84:

regex_replace

# This is the commit message StreisandEffect#85:

regex_replace

# This is the commit message StreisandEffect#86:

langauge_name

# This is the commit message StreisandEffect#87:

item in loop

# This is the commit message StreisandEffect#88:

trying iteritems

# This is the commit message StreisandEffect#89:

ocserv i18n

# This is the commit message StreisandEffect#90:

openvpn i18n

# This is the commit message StreisandEffect#91:

fixed stunnel status

# This is the commit message StreisandEffect#92:

updated shadowsocks instructions

# This is the commit message StreisandEffect#93:

shadowsocks i18n

# This is the commit message StreisandEffect#94:

finished ssh i18n

# This is the commit message StreisandEffect#95:

finished gateway i18n

# This is the commit message StreisandEffect#96:

adding index and firewall fr

# This is the commit message StreisandEffect#97:

finished tor i18n, adding .html to templates

# This is the commit message StreisandEffect#98:

finished wg i18n

# This is the commit message StreisandEffect#99:

wg with_dict not with_items

# This is the commit message StreisandEffect#100:

fixed streisand mirror index task

# This is the commit message StreisandEffect#101:

fixed shadowsocks mirror index fr

# This is the commit message #102:

streisand_markdown_mirror_page removed

# This is the commit message StreisandEffect#103:

streisand_ci = no

# This is the commit message StreisandEffect#104:

fixed tor gateway instructions

# This is the commit message StreisandEffect#105:

hopefully fixes all page generation issues

# This is the commit message StreisandEffect#106:

updated index-fr.html

# This is the commit message StreisandEffect#107:

l2tp oconnect should generate correctly now

# This is the commit message StreisandEffect#108:

fixed mirror links for i18n

# This is the commit message StreisandEffect#109:

finished remaining translation, mirror link fixes

# This is the commit message StreisandEffect#110:

fixed stunnel instructions

# This is the commit message StreisandEffect#111:

hopefully the last of the corrections

# This is the commit message StreisandEffect#112:

typos and grammatics

# This is the commit message StreisandEffect#113:

more corrections

# This is the commit message StreisandEffect#114:

mirroring french localized tor

# This is the commit message StreisandEffect#115:

minor corrections

# This is the commit message StreisandEffect#116:

clarifications

# This is the commit message StreisandEffect#117:

Somme de contrôle

# This is the commit message StreisandEffect#118:

s/potatso/cross

# This is the commit message StreisandEffect#119:

changed google links for fr to hl=fr

# This is the commit message StreisandEffect#120:

copypasta quirk

# This is the commit message StreisandEffect#121:

cleanup, removed shadowsocks OTA

# This is the commit message StreisandEffect#122:

removed shadowsocks from unattended upgrades

# This is the commit message StreisandEffect#123:

removed unecessary stuff from unattended upgrades

# This is the commit message StreisandEffect#124:

Streisand CI Testing

# This is the commit message StreisandEffect#125:

CI updates based on feedback

# This is the commit message StreisandEffect#126:

permissions

# This is the commit message StreisandEffect#127:

updated readme-fr

# This is the commit message StreisandEffect#128:

Update readme-fr

No need for brew update anymore

# This is the commit message StreisandEffect#129:

removed ci
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@psifertex @jlund @kyhwana @ddworken