topic Re: DNS Tunneling IPS in Firewall and Security Management

DNS Tunneling IPS

Goose — Thu, 01 Jul 2021 13:41:25 GMT

I understand the basics of what DNS tunneling is and have recently enabled this IPS protection in our Threat Prevention Profile. What I have been unable to find is exactly how this IPS protection actually works. What is it doing and looking for to stop a DNS tunnel?

Secondarily I would like to know how to test this but first need to know what this protection is doing in order to accomplish that.

Thank you.

Goose

Re: DNS Tunneling IPS

PhoneBoy — Sat, 03 Jul 2021 04:27:55 GMT

A large number of specific types of queries will trigger the DNS Tunneling protection.
Unfortunately, we do not publicly share the precise details of how we enforce this protection.

Re: DNS Tunneling IPS

Goose — Sat, 03 Jul 2021 14:02:05 GMT

I understand and that makes some sense. Can you point me toward and one particular way that I could test that it is indeed working? I recall seeing in one post (granted it was a particular upgrade scenario) that it was not working. I would just like to be able to trigger and verify. Thank you.

Re: DNS Tunneling IPS

PhoneBoy — Sat, 03 Jul 2021 15:30:57 GMT

Nothing I can share publicly.
Recommend reaching out to your local Check Point SE.

Re: DNS Tunneling IPS

Vladimir — Sun, 04 Jul 2021 12:35:58 GMT

You can try dns2tcp tool in Kali Linux to test it: https://tools.kali.org/maintaining-access/dns2tcp

I am not sure how many packets it should see to be triggered though.

Re: DNS Tunneling IPS

Goose — Sun, 04 Jul 2021 13:29:27 GMT

Thank you Vladimir. I will try and let you know.