0
$\begingroup$

Assuming I have firewall set to block an application from accessing the Internet, would I DNS request go through?

I tried using C (gethostbyname) on Windows and the answer is no. It seems that the application sends the DNS request to the public DNS server, but I wonder if this is the same under Linux.

In particular, could there be that there is a local DNS server (loopback interface) running on the OS such that gethostbyname would instead use the local DNS for the requests. Firewalls may block public packets but for private subnets especially for loopback that may be allowed to applications depending on how one configures the firewall. This way a block app would place a request to an unblocked app (DNS local relay server) that can communicate with a remote system.

Improve this question
$\endgroup$
2
  • $\begingroup$ Welcome to COMPUTERSCIENCE @SE. Can you emphasise the CS angle? $\endgroup$
    – greybeard
    Aug 9, 2020 at 1:33
  • $\begingroup$ Security is part of computer science. How a DNS request is made based on gethostbyname() is both a programming and an OS question (with some networking). $\endgroup$
    – Michael
    Aug 9, 2020 at 17:53

1 Answer 1

Reset to default
1
$\begingroup$

It depends on the policy enforced by the firewall. If it blocks outbound DNS requests, then the request wouldn't go through; if it doesn't, the request would go through. A firewall is a mechanism; it has to be configured with a policy that determines which packets or connections are allowed and which are blocked. Just saying you have a firewall does not tell us what policy you have chosen to have it enforce.

The details of how gethostbyname() behaves are beyond the scope of this site.

You certainly could have a situation where the firewall blocks an application from making DNS requests to the outside world but allows them to a local DNS server; and where the local DNS server acts as a resolver or a proxy and itself makes requests to the outside world. That will depend on the firewall and how it is configured as well as the DNS server and how it is configured.

Improve this answer
$\endgroup$
2
  • $\begingroup$ How syscalls like gethostbyname behave makes a big difference. If they open a socket and send a UDP packet on 53 from the application then that can be blocked. If instead gethostbyname sends a request to a local DNS service that runs on a system then you will see two behaviors, one the application sending a udp to 127.0.0.1 on 53 and then the DNS server attempting to do the back and forth with a dns server. Most desktop firewalls will block traffic on the basis of applications, so I am wondering if this leaves room for a malware to circumvent that and use DNS as a covert channel. $\endgroup$
    – Michael
    Aug 8, 2020 at 18:08
  • $\begingroup$ @Michael, that is product specific, and I expect it will depend on the particular firewall. If you're interested about the specifics of a particular platform or technology, you might do better to ask on Security.SE. My understanding is that the behavior of gethostbyname depends on the particular platform you're running on and what you've configured as the DNS resolver; but I'm not an expert on that and I might well have a misunderstanding. $\endgroup$
    – D.W. ♦
    Aug 8, 2020 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.