Differences

This shows you the differences between two versions of the page.

--- computing:dnshijack [2026/09/06 02:05] – oemb1905
+++ computing:dnshijack [2026/09/06 02:07] (current) – removed oemb1905
@@ Line 1: / Line 1: @@
--------------------------------------------
-  * **dnshijack**
-  * **Jonathan Haack**
-  * **Haack's Networking**
-  * **webmaster@haacksnetworking.org**
--------------------------------------------
-//DNS Hijack//
--------------------------------------------
-**1. Static DHCP leases**
-LuCI → Network → DHCP and DNS → Static Leases. Establish statics for each camera or OIT device, which helps for tcpdump tracking later.
-{{ :computing:dhcp.png?direct&1000 |}}
-**2. Port 53/853 intercept for direct udp on either port**
-LuCI → Network → Firewall → Port Forwards / Incoming.
-<code>
-- Name: Camera1
-- Restrict to address family: IPv4 only
-- Protocol: TCP + UDP
-- Source zone: res
-- External port: 53
-- Destination zone: res
-- Internal IP address: 172.66.66.150 (ns5.haacksnetworking.org)
-- Internal port: 53
-Advanced Settings
-- Source MAC address:
-:48:2C:44:C7:7D
-:48:2C:41:71:78
-:48:2C:41:69:FF
-:48:2C:46:0E:C4
-</code>
-{{ :computing:udp.png?direct&1000 |}}
-I decided to give the first two cams/OIT devices back to ns5 and the other two cams/OIT devices back to ns6.
-**3. DoH / DoT drop**
-LuCI → Network → Firewall → Traffic Rules.
-<code>
-- Name: `Camera DoH`
-- Family: IPv4 and IPv6
-- From: zone `res`
-- Specify the MACs:
-:48:2C:41:69:FF
-:48:2C:41:71:78
-:48:2C:44:C7:7D
-:48:2C:46:0E:C4
-- To: zone `wan`
-# Specify that these IPs are blocked (add as needed):
-.1.1.1
-.0.0.1
-.8.8.8
-.8.4.4
-.9.9.9
-.112.112.112
-.140.14.14
-.140.15.15
-.67.222.222
-.67.220.220
-.228.168.9
-.228.169.9
-.76.2.0
-.76.10.0
-.90.28.0
-.90.30.0
-- Ports: `443`, `853`
-- Action: Drop
-</code>
-{{ :computing:doh.png?direct&1000 |}}
-Then, once these are setup, confirm using tcpdump on your openWRT router. The basic tcpdump commands to check wan interface (eth1) for leaks:
-  tcpdump -ni eth1 udp port 53 and '( host 8.8.8.8 or host 8.8.4.4 or host 1.1.1.1 or host 1.0.0.1 or host 9.9.9.9 )'
-  tcpdump -ni eth1 '(tcp port 443 or tcp port 853 or udp port 853)' and '(host 8.8.8.8 or host 8.8.4.4 or host 1.1.1.1 or host 1.0.0.1 or host 9.9.9.9 )'
-  tcpdump -ni eth1 ip6 and udp port 53 and '( host 2001:4860:4860::8888 or host 2001:4860:4860::8844 or host 2606:4700:4700::1111 or host 2606:4700:4700::1001 or host 2620:fe::fe )'
-  tcpdump -ni eth1 ip6 and '(tcp port 443 or tcp port 853 or udp port 853)' and '( host 2001:4860:4860::8888 or host 2001:4860:4860::8844 or host 2606:4700:4700::1111 or host 2606:4700:4700::1001 or host 2620:fe::fe )'
-Or, run all at once:
-<code>
-tcpdump -ni eth1 '
-  (
-    udp port 53 or
-    tcp port 443 or
-    tcp port 853 or
-    udp port 853
-  ) and (
-    host 8.8.8.8 or host 8.8.4.4 or
-    host 1.1.1.1 or host 1.0.0.1 or
-    host 9.9.9.9 or
-    host 2001:4860:4860::8888 or host 2001:4860:4860::8844 or
-    host 2606:4700:4700::1111 or host 2606:4700:4700::1001 or
-    host 2620:fe::fe
-  )
-'
-</code>
-Or, to just check the cameras (use static ips on the restricted zone) traffic in entirety:
-  tcpdump -i br-lan.179 host 172.66.66.105 or host 172.66.66.106 or host 172.66.66.107 or host 172.66.66.108 -n
-Or, just check outbound 53 / 853, direct udp:
-  tcpdump -i br-lan.179 host 172.66.66.105 or host 172.66.66.106 or host 172.66.66.107 or host 172.66.66.108 -n | egrep '(\.53 |\.853 )'
-Or, check 443 and 853 while stripping the okay stun/turn they need for the app:
-  tcpdump -i br-lan.179 host 172.66.66.105 or host 172.66.66.106 or host 172.66.66.107 or host 172.66.66.108 -n | egrep -v '(\.443|\.3478|\.8883|ARP)'
-You have to run tcpdump and bird's eye look at the pihole dashboard initially. You will suddenly see that the direct DNS udp/53 it runs to 8.8.8.8 and 8.8.4.4 that are widely reported are now being intercepted. You confirm on tcpdump by checking the wan outgoing ... to see if anything gets by. You can tell on the piholes because initially you won't see any domains, but as soon as you set up the forwards correctly, you will get a slew of domains popping off:
-{{ :computing:150.png?direct&400 |}}
-{{ :computing:160.png?direct&400 |}}
-Before I began, I blocked the following in pihole's domain section. I got these from forums / online resources. So far, the cams have not pinged any of these, but better safe than sorry:
-{{ :computing:forum.png?direct&1000 |}}
-Alright,
- --- //[[alerts@haacksnetworking.org|oemb1905]] 2026/09/06 00:56//

Haack's Wiki

User Tools

Site Tools

Differences

Page Tools