IP over DNS.

[Darren Reed <avalon () coombs anu edu au>]

I'm surprised nobody has mentioned IP over DNS here yet -
afterall, it's on /. ;-)

http://nstx.dereference.de/nstx/

Is the particular implementation in this instance.

- there's some more work there for IDS people ;_)

The biggest problem is that without doing bad things to
DNS*, you can't stop this from being setup without putting
in place a full proxy based firewall.  Why ? In order for
a packet filter firewall to work, hosts inside need to be
able to get outside address information and that's what
we need to deny people in order to stop the above.

Does this spell the end of packet filtering for high
security firewalls ?

Darren
* - bad things includes filtering out certain types of DNS
packets such as TXT records.

_______________________________________________
Firewall-wizards mailing list
Firewall-wizards () nfr net
http://www.nfr.net/mailman/listinfo/firewall-wizards