DNS with Packet Tunnel Provider

Question

Created Dec ’20

Replies 1

Boosts 0

Participants 2

I'm working on building a custom Packet Tunnel Provider and I'm running into a group of related problems surrounding how DNS appears to be handled.

If I don't specify dnsSettings in my NEPacketTunnelNetworkSettings then nothing resolves and the tunnel is useless.

So I tried setting a specific DNS resolver; that solves the problem of DNS resolution and the tunnel works, but those DNS requests are sent outside the tunnel and I don't see a way to enforce them going through the tunnel. This is a problem as plain text DNS requests are a big information leak.

I next tried to set the dnsSettings to an NEDNSOverHTTPSSettings object pointing to cloudflare's public DoH server. That doesn't appear to work. No DNS requests are seen over the wire, but nothing resolves so it's just as useless as the original state.

Is there something I'm missing here w/r/t DNS setting on packet tunnel providers?

Boost

Answer 1

Systems Engineer OP

Apple

Jan ’21

So I tried setting a specific DNS resolver; that solves the problem of DNS resolution and the tunnel works, but those DNS requests are sent outside the tunnel and I don't see a way to enforce them going through the tunnel.

One way to do this is to setup a specific resolver and create a set of matchDomains that you care about:

Code Block objcNEDNSSettings *dnsSettings = [[NEDNSSettings alloc] initWithServers:@[@"x.x.x.x"]];
dnsSettings.matchDomains = @[@"apple.com"];
dnsSettings.matchDomainsNoSearch = YES;
settings.DNSSettings = dnsSettings;

Then when you read these packets from your virtual interface with a method like readPacketsWithCompletionHandler, you can encrypt this traffic before it is sent out over the network using your own resolvers encryption technique, or a publicly hosted resolvers encryption method, but this would require you to setup your own DoT functionality. Next, if you wish for this traffic to continue through an in-provider network class, use NWUDPSession and this should get you started.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

0