Tor on Linux. DNAT port 53 DNS requests to TOR DNS listener port set to 9041 on 127.0.0.1 with iptables. tcpdump shows my def gateway replies. strange

Question

Tor on Linux. DNAT port 53 DNS requests to TOR DNS listener port set to 9041 on 127.0.0.1 with iptables. tcpdump shows my default gateway answers to same client port.

[root@localhost memyself]# tcpdump -nni lo | grep -iF '.53 .9041'
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
23:37:39.845298 IP 192.168.2.5.53311 > 127.0.0.1.9041: UDP, length 28
23:37:39.981214 IP 192.168.2.254.53 > 192.168.2.5.53311: 31087 1/0/0 A 23.4.230.19 (44)
23:37:39.982541 IP 192.168.2.5.46980 > 127.0.0.1.9041: UDP, length 28
23:37:40.078528 IP 192.168.2.254.53 > 192.168.2.5.46980: 5315 NXDomain 0/0/0 (28)
23:37:40.079020 IP 192.168.2.5.36305 > 127.0.0.1.9041: UDP, length 28
23:37:40.079067 IP 192.168.2.254.53 > 192.168.2.5.36305: 20568 NotImp 0/0/0 (28)

Isn't that strange or am i missing something? However, when tcpdump dumps my wifi adapter, there is no tcpdump output.

Answer 1

It's because of the wrong firewall logic. Quite a lot of scripts are proposing DNAT - and this is wrong! You have to provide a local DNS resolver - I recommend Bind 9 - and give it to your clients via DHCP or a static field value. After this DROP ALL outgoing private network traffic for a client interface and only after thet utilize TransPort transparent proxy. For a local/single host implement this either via virtual machines or containers - or by per-user rules feature. But do not ever use DNAT!

UPDATE for a comment:

ISC Bind was quite a pain in the ass and a resource hog until version 9, yes - but they have made a great work to fix it, your 4Gb laptop won't even notice it! Inside the Bind config you're just forwarding any query about dot-onion zone to Tor's DNSport and relove recursivly all the rest without any forwarders from your ISP that are spying on you and censoring your queries in most of the cases. You don't need any kind of VM or even a Docker container for that - just deploy it on your host OS and be happy about it's benefits. The DNS leaks in form of the queries to an upstream DNS server are side effects of DNAT logic mailfunctioning: it's not for it, for sure! And you simply can't handle all the cases possible using it: at least you can't handle a case when the resolving is performed with a server forcibly specified like this: nslookup example.com 8.8.8.8 - or you will have to divert any DNS query to some static destination like your Tor instance, but... But port 53 is not the only one that can be used for a DNS server - it can be any port, actually nslookup -port=12345 example.com 1.1.1.1 will jailbreak from this scenario easily: because you physically can't forward all the requests to the DNS port, it won't work. So either you have a routing+TransProxy as I described - or you're using socks5s or HTTPS proxy for your clients. And a VM here will fit just fine even in your 4Gb laptop for a single-host setup. Here is the trick:

1. At first, just install Debian netinst with a minimal package selection just with command line tools inside your VM.
2. Compile kernel by hand from kernel.org Torvalds branch or just take a last stable build from a first page of kernel.org. When configuring it - do not build drivers that are not loaded, so you will have a kernel with a minimal footprint tailored just for your VM
3. Use this minimal kernel by dpkg-installing it and route this VM through your host with TransProxy and DNS as I said. So not enable ssh and any other unneeded service! Your overhead for having a VM will be less than 100Mb ram and like 500m on your hard drive: all the rest of resources will spent be exactly the same to run your apps you need to pass through Tor anonymously!