computing:dnshijacks
Differences
This shows you the differences between two versions of the page.
| Next revision | Previous revision | ||
| computing:dnshijacks [2026/09/06 02:07] – created oemb1905 | computing:dnshijacks [2026/09/06 02:56] (current) – oemb1905 | ||
|---|---|---|---|
| Line 40: | Line 40: | ||
| </ | </ | ||
| - | {{ :computing:udp.png? | + | {{ :computing:udp2.png? |
| I decided to give the first two cams/OIT devices back to ns5 and the other two cams/OIT devices back to ns6. | I decided to give the first two cams/OIT devices back to ns5 and the other two cams/OIT devices back to ns6. | ||
| Line 122: | Line 122: | ||
| tcpdump -i br-lan.179 host 172.66.66.105 or host 172.66.66.106 or host 172.66.66.107 or host 172.66.66.108 -n | egrep -v ' | tcpdump -i br-lan.179 host 172.66.66.105 or host 172.66.66.106 or host 172.66.66.107 or host 172.66.66.108 -n | egrep -v ' | ||
| + | | ||
| + | After catching some leaks due to destination zone being set on 53/853 direct udp, revised this command to monitor WAN with time stamps to see what gets by and when: | ||
| + | |||
| + | < | ||
| + | tcpdump -ni eth1 -vvv -tttt ' | ||
| + | (host 172.66.66.105 or host 172.66.66.106 or host 172.66.66.107 or host 172.66.66.108) | ||
| + | and not ( | ||
| + | udp port 123 or | ||
| + | (udp portrange 10000-65535 and not udp port 53 and not udp port 853) | ||
| + | ) | ||
| + | ' | ||
| + | </ | ||
| You have to run tcpdump and bird's eye look at the pihole dashboard initially. You will suddenly see that the direct DNS udp/53 it runs to 8.8.8.8 and 8.8.4.4 that are widely reported are now being intercepted. You confirm on tcpdump by checking the wan outgoing ... to see if anything gets by. You can tell on the piholes because initially you won't see any domains, but as soon as you set up the forwards correctly, you will get a slew of domains popping off: | You have to run tcpdump and bird's eye look at the pihole dashboard initially. You will suddenly see that the direct DNS udp/53 it runs to 8.8.8.8 and 8.8.4.4 that are widely reported are now being intercepted. You confirm on tcpdump by checking the wan outgoing ... to see if anything gets by. You can tell on the piholes because initially you won't see any domains, but as soon as you set up the forwards correctly, you will get a slew of domains popping off: | ||
| Line 134: | Line 146: | ||
| Alright, this is an improved version of my prior setup, dedicated to Bender. | Alright, this is an improved version of my prior setup, dedicated to Bender. | ||
| - | --- // | + | Notes: |
| + | * Noticed that openWRT was missing some direct outgoing due to des zone being set, removed | ||
| + | * Added '' | ||
| + | * Experimenting with changing the des zone to wan instead - nevermind, blank better (includes wan) | ||
| + | |||
| + | |||
| + | --- // | ||
computing/dnshijacks.1788660466.txt.gz · Last modified: by oemb1905
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: GNU Free Documentation License 1.3
