DNS reverse proxy

I have a server with a single IPv4 and I want to run two DNS servers:

• one to serve zones like stalkr.net - if you recall, I like PowerDNS;
• another one for tunneling - I like dns2tcp (TCP level), another good one is iodine (IP level).

Problem: I looked a bit but none of the DNS server software I've seen support forwarding queries that aren't for them to another server. Basically what I need is a reverse proxy that looks at the DNS query, and route it based on the name. It's the same as an HTTP reverse proxy that looks at the Host field to proxy the request to another server. I tried to hack with resolvers and stub/forward zones but it didn't work.

So I made my own dns-reverse-proxy in just a few lines of Go, using a fully featured DNS library. It's running smoothly, if you have the same need feel free to use it!

Going DNSSEC, Unbound and PowerDNS

stalkr.net is now signed with DNSSEC! In this post I will quickly describe what is DNSSEC and why I chose to deploy it, then my choice of Unbound as a resolver and PowerDNS as a server and finally give a few resources about this topic.

Hack.lu CTF - Challenge 9 "bottle" writeup, extracting data from an iodine DNS tunnel

Challenge #9 entitled "bottle" was original and worth its 500 points. We were given the following network capture and instructed to find a message.

Opening the capture in Wireshark reveals a lot of DNS traffic (and 4 ARP requests): it definitely looks like a DNS tunnel.

Free secondary DNS services

If you run an authoritative DNS server and serve your own zones you may know about the need to have decent secondary DNS servers, or "slaves", to back you up. I recently changed mine, followed recommendations by Frankb's page and found new ones.

August 2019 update: so far these are great, so passing the word.

• puck.nether.net: simple, IPv4+IPv6, supports DNSSEC, 1 location; fairly quick to update usually, but had troubles recently (2019-08) so I removed it
• freedns.afraid.org: simple, IPv4, supports DNSSEC, 1 location; a bit slow to update, sometimes times out, but otherwise stable for years
• BuddyNS: fancy, but DNSSEC support is not free, so no
• 1984hosting: simple, IPv4+IPv6, supports DNSSEC, 3 NS; new one I'm trying, so far so good, fast to update