free Internet MALI DNSTT DNS tunnel

A DNS tunnel is one way of circumventing network censorship. A recursive DNS resolver’s purpose is to receive packets and forward them somewhere else—in effect, working as a kind of network proxy. DNS tunnels over plaintext UDP are generally considered easy to detect because of the unusual DNS messages they use. However DoH and DoT are encrypted—an outside observer can see that you are communicating with a public resolver, but cannot decrypt the raw DNS messages to see that they embed a tunnel protocol. (The resolver itself can still easily tell that you are using a tunnel.)

How to set it up

dnstt doesn’t offer a TUN/TAP network interface, or even a SOCKS or HTTP proxy interface, only a netcat-like connection between a local TCP socket and a remote TCP socket. However, it’s fairly easy to make the tunnel act like a standard proxy server by running a proxy at the tunnel server.

A DNS tunnel works by having the tunnel server act as an authoritative resolver for a specific domain name. The recursive resolver in the middle acts as a proxy by forwarding queries for that domain to the tunnel server. To set up a DNS tunnel, you need a domain name and a host that can receive UDP packets, where you run the tunnel server. In these instructions, we’ll assume the following example setup:

Your domain name	example.com
Your server’s IPv4 address	203.0.113.2
Your server’s IPv6 address	2001:db8::2

DNS setup

Go into your name registrar’s configuration panel and add three records:

A	tns.example.com	points to	203.0.113.2
AAAA	tns.example.com	points to	2001:db8::2
NS	t.example.com	is managed by	tns.example.com

tns.example.com points to the addresses of your tunnel server. It is marked as being the nameserver for everything in the t.example.com DNS zone. When a recursive resolver receives a query for subdomain.t.example.com, it will forward the query to the tunnel server—that is how the client tunnels data to the server.

The “tns” and “t” labels can be anything you want, but the “tns” label should not be a subdomain of the “t” label (everything under that subdomain is reserved for tunnel payloads). The “t” label should be short, because there is limited space available in a DNS message, and the domain name takes up part of it.