Cyber Stalking and IpFire

[hvacguy (Shaun HVAC)]

If using something like Pihole.
I think the easiest way would be
1 firewall rule to allow Pihole to ports 53 and 853 DNS.
And a 2nd rule to block all others.
This would force them to use Pihole DNS.
Piholes DNS could be / Should be IPFire.

[nickh (Nick Howitt)]

But the idea was to also hijack DNS in case users had other DNS servers configured, and not just to block them…

[hvacguy (Shaun HVAC)]

That’s why firewall rule 2.
Block everyone else the whole network.

[nickh (Nick Howitt)]

Rather than block, we wanted to redirect it to PiHole with a Port Forward. This then requires an SNAT rule as well, but the UI blocks you from doing it.

[hvacguy (Shaun HVAC)]

This defeats IPFires DNS DNSSEC protection.
You are counting on Pihole for All DNS.

I my example Pihole gets DNS from IPFire.
Users get DNS from Pihole.
No DNS bypass.

Except DOH is more difficult.

[nickh (Nick Howitt)]

Here PiHole should be getting DNS from IPF if they manage to work out the exception rule mentioned much higher up.

[bbitsch (Bernhard Bitsch)]

I do not see the problem here.
iptables rules are applied in the defined sequence, so

1. allow DNS for PiHole
2. redirect DNS to PiHole

should do the job. Rule 2 isn’t applied to DNS requests from PiHole, because of rule 1.

EDIT: to avoid loops this can be extended to

1. allow PiHole:<some port> → IPFire:<DNS ports>
2. deny PiHole:<some port> → :<DNS ports>
3. redirect DNS to PiHole

[nickh (Nick Howitt)]

That is the easy bit. Applying the required SNAT rule is a bit trickier.

[bbitsch (Bernhard Bitsch)]

What SNAT rule?

[nickh (Nick Howitt)]

Cyber Stalking and IpFire

For anything hijacked you may also need an SNAT rule so DNS traffic to PiHole from the Green LAN appears to come from Green0 and not the LAN IP. This is because otherwise packets get sent from a LAN device from to IPfire and get redirected to PiHole which is also on the green LAN. PiHole returns the packet directly to the LAN device which won’t like it as he sent his packet to Green0 and will only accept a return packet from where he sent it and not direct from PiHole.

Cyber Stalking and IpFire

Yes. In this case I am pretty certain we require SNAT to successfully hijack the DNS. It can be done with a manual rule but it means using firewall-local - www.ipfire.org - firewall.local.

Cyber Stalking and IpFire

But the source isn’t Green0, even though the packet is coming via Green0. As far as I can see, it will need a custom rule in the start section: iptables -I CUSTOMPOSTROUTING -t nat -s your_green_LAN_subnet -d 192.168.1.33 -p tcp -m multiport --dports 53,853 -j SNAT --to-source 192.168.1.1 iptables -I CUSTOMPOSTROUTING -t nat -s your_green_LAN_subnet -d 192.168.1.33 -p udp -m multiport --dports 53,123 -j SNAT --to-source 192.168.1.1 If you leave off the port and protocol selector you can do it …