DNS Hijacking Linux

[osousa]

Hi there,

i disabled dnsmasq or any other DNS service on my machine,

i ran the following:

./tun2socks-linux-arm64 -device tun0 -proxy direct:// -loglevel debug -interface end0

It wasn't able to run as expected, i added the following iptables' rules as explained on the FAQ:

iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to 9.9.9.9:53;                                                                   
iptables -t nat -A POSTROUTING -p udp -d 9.9.9.9 --dport 53 -o end0 -j MASQUERADE;

It started working!

Then i tried the same but with the proxy

./tun2socks-linux-arm64 -device tun0 -proxy socks5://user:password@server:port -loglevel debug -interface end0
INFO[0000] [DIALER] bind to interface: end0             
INFO[0000] [STACK] tun://tun0 <-> socks5://server:port 
WARN[0001] [UDP] dial 9.9.9.9:53: client handshake: UDP ASSOCIATE: general SOCKS server failure 
WARN[0001] [UDP] dial 9.9.9.9:53: client handshake: UDP ASSOCIATE: general SOCKS server failure 
WARN[0002] [UDP] dial 9.9.9.9:53: client handshake: UDP ASSOCIATE: general SOCKS server failure 
WARN[0002] [UDP] dial 9.9.9.9:53: client handshake: UDP ASSOCIATE: general SOCKS server failure 
WARN[0004] [UDP] dial 9.9.9.9:53: client handshake: UDP ASSOCIATE: general SOCKS server failure 
WARN[0006] [UDP] dial 9.9.9.9:53: client handshake: UDP ASSOCIATE: general SOCKS server failure 
WARN[0006] [UDP] dial 9.9.9.9:53: client handshake: UDP ASSOCIATE: general SOCKS server failure 
WARN[0006] [UDP] dial 9.9.9.9:53: client handshake: UDP ASSOCIATE: general SOCKS server failure 
WARN[0006] [UDP] dial 9.9.9.9:53: client handshake: UDP ASSOCIATE: general SOCKS server failure 

It tries to send the UDP packets to the server, why?

[xjasonlyu]

Hi there,

Can you confirm UDP is working between your proxy server and tun2socks first?

For the reason why all your UDP packets were sent to the server is because you use iptables to modify the destination. :)

[osousa]

Very curious case... the socks5 server does not allow for UDP (using merino socks5 proxy server) but it shouldn't be an issue.

Made a few tests, even setup dnsmasq on port 53 on my server, which is open , and it works with "direct". I can use the DNS forwarder to resolve the names from there:

iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to myserver_ip:53;                                                                   
iptables -t nat -A POSTROUTING -p udp -d myserver_ip --dport 53 -o end0 -j MASQUERADE;

using "direct://" works like a charm using my server as a DNS forwarder. I know its my server's dnsmasq doing the work ,as soon as i shut down dnsmasq on the server, socks5 client stops working.

Thank you very much for trying to help out!

PS: Thinking twice, maybe the socks5 server itself must accept UDP in fact... i wonder how is it that i can use it with proxychains or v2ray without issues. Maybe they all resolve the names themselves. I don't know much about networking to be honest, but i'll maybe try another socks5 server. If you can suggest a lightweight and fast one, i'm all ears :)

[osousa]

btw, i thought that the tun0 interface was where traffic from proxy would travel through, and the end0 interface would remain intact, to where i could still send traffic without passing through the proxy. But it seems it kind of bridges or binds the two together, i guess? So there's no way of leaving or creating a route to where i could still send unproxied traffic, like DNS requests?