{"id":960,"date":"2022-06-11T12:45:20","date_gmt":"2022-06-11T11:45:20","guid":{"rendered":"https:\/\/www.labtinker.net\/?p=960"},"modified":"2022-06-11T12:45:20","modified_gmt":"2022-06-11T11:45:20","slug":"call-the-dns-doctor","status":"publish","type":"post","link":"http:\/\/18.135.13.153\/?p=960","title":{"rendered":"Call the DNS Doctor"},"content":{"rendered":"\n

I never really knew DNS doctoring was much of a thing until I encountered it: essentially getting your firewall to alter or doctor DNS responses. One use case for this might be that you can have your internal hosts receive an internal DNS address whilst keeping them pointing to an external ISP’s DNS. I could go on but somebody already has:<\/p>\n\n\n\n

https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/security\/asa-5500-x-series-next-generation-firewalls\/115753-dns-doctoring-asa-config.html<\/a><\/p>\n\n\n\n

So I thought I would have a tinker. This is my set up in GNS3. A Linux host connecting to the Internet through an ASA which will be doing the doctoring….<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The ASA has the following interfaces:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The linux host (MintWeb2-1) in on the inside interface of the ASA, the Internet is on the outside interface and the following NAT statements are in place:<\/p>\n\n\n\n

nat (inside,outside) source dynamic any interface<\/em><\/p>\n\n\n\n

nat (inside,outside) source static Loopback_127.0.0.1 Labtinker_3.8.120.91 dns<\/em><\/p>\n\n\n\n

(You can’t use addresses in the nat statement but have to use objects – thus I defined two host objects and named them with the addresses – to make it clear what’s going on)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

This looks like this on the ASA’s ASDM GUI:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The first NAT statement is to PAT traffic to the Internet but the next one does the clever stuff. Essentially, it will alter any DNS responses containing the address 3.8.120.91 and replace said address with 127.0.0.1. <\/p>\n\n\n\n

The Linux host is set up to get its DNS from the Internet DNS server(s) on 8.8.8.8 and so when it browses to 18.135.13.153\/<\/em>, the Internet DNS will respond with an address of 3.8.120.91 but the ASA will intercept this response and change it to 127.0.01 (the host’s loopback address). <\/p>\n\n\n\n

It should be noted, as mentioned in the explanatory link abov, that you need dns inspection defined on your ASA for this to work (it should be set up by default)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

And well, dear reader, it works… From the Linux host I browsed out to 18.135.13.153\/<\/em> which and was re-directed to the webserver on the host’s own loopback address: (127.0.0.1).<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

To see the DNS doctoring working on the ASA I did the following: Set up a capture to 8.8.8.8<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Cleared the DNS cache:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

And then browsed out again to 18.135.13.153\/<\/em><\/p>\n\n\n\n

There are various ways to get a pcap of the capture from the ASA but one is:<\/p>\n\n\n\n

https:\/\/<ip_of_asa>\/admin\/capture\/<capture_name>\/pcap<\/a><\/p>\n\n\n\n

Which in my case is:<\/p>\n\n\n\n

https:\/\/192.168.140.111\/admin\/capture\/dns\/pcap<\/a><\/p>\n\n\n\n

(You have to authenticate with the ASA) <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

You may want to rename the pcap but after opening it with Wireshark we can see the traffic and begin looking out for dns address responses…<\/p>\n\n\n\n

(I added a column in Wireshark for the DNS address response or you can find a DNS address response in the trace and just add it as a column)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

And then sorting on this field and looking for 127.0.0.1 lo and behold:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I repeated the capture on the outside interface where I expected the original address to seen in the DNS response and indeed it was…<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The doctor is now getting himself a beer (me, not the firewall).<\/p>\n","protected":false},"excerpt":{"rendered":"

I never really knew DNS doctoring was much of a thing until I encountered it: essentially getting your firewall to alter or doctor DNS responses. One use case for this might be that you can have your internal hosts receive an internal DNS address whilst keeping them pointing to an external ISP’s DNS. I could […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,7],"tags":[],"class_list":["post-960","post","type-post","status-publish","format-standard","hentry","category-dns","category-firewalls"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/posts\/960","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=960"}],"version-history":[{"count":0,"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/posts\/960\/revisions"}],"wp:attachment":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=960"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=960"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=960"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}