Re: dns outbound

["Marcus J. Ranum" <mjr () clark net>]

Ryan Russell wrote:
> Another claimed that one of his uses was able to
> surf the web without having to authenticate on the
> way out, via the DNS rule.

If you have access to an external system, someplace, you can
use DNS packets to contain IP packets, or you can set up
an application-level proxy that tunnels over DNS packets.
Kind of a lot of work, but a technically knowledgeable person
behind a firewall that he/she didn't like could do it easily
enough. This is a basic problem with firewalls: so much
stuff can be pushed back and forth through them that they're
very easy to tunnel through. What scares me is the (obvious)
implication of a "firewall-aware" tunnelling trojan horse/virus
that opens outgoing connections via HTTP or other protocols
that firewalls typically allow.

mjr.
--
Marcus J. Ranum, CEO, Network Flight Recorder, Inc.
work - http://www.nfr.net
home - http://www.clark.net/pub/mjr