Join GitHub today
GitHub is home to over 20 million developers working together to host and review code, manage projects, and build software together.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
Already on GitHub? Sign in to your account
Add --dns-hosts command-line option. #22
Conversation
apenwarr
and others
added some commits
Jan 2, 2012
peyoot
commented on 9ce2fa0
Feb 11, 2015
|
I use this command: sshuttle -D --dns -vvr user@ip:port 0/0 ,to make it run as daemon. But how can I disconnect it? does sshuttle provide any shortcut key to stop or kill the corresponding threads? |
Hasimir
added a commit
to Hasimir/sshuttle
that referenced
this pull request
Jun 24, 2015
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Narthorn commentedApr 30, 2013
The --dns switch adds firewall rules to intercept queries only for
nameservers found in resolv.conf ; This command-line option allows
the user to explicitly specify the nameservers to create firewall
redirection rules for.
This is useful when using a local DNS forwarder to redirect DNS queries
to different nameservers.
Example:
We can use sshuttle to access a private subnet 172.30.0.0/16, which hosts
a local DNS server resolving private domain names in that subnet.
Currently, the only way to be able to resolve those domain names is to use
the --dns switch. However, all DNS queries will then go through the remote
nameserver, which might not be desirable especially if said nameserver
does not know how to resolve every query.
One solution is to run a local DNS forwarder, which knows that the private
domain names can be resolved through a private IP, say 172.30.128.40.
Now, we can run :
DNS queries for private domain names will get forwarded to 172.30.128.40,
intercepted by the firewall rule and sent through the tunnel to the nameserver
used by the remote endpoint (which might or might not be 172.30.128.40 !).
Notes :
--dns, in which case the nameservers found in resolv.conf will also be
added to the firewall rules as usual. This defeats the purpose of the
example, however.
There might be some weird use-case where this is useful ?
after it has crossed the tunnel, the IPs specified in --dns-hosts are
irrelevant (as long as they are the same as found in the DNS forwarder
configuration). This might be a little counter-intuitive.