GhostGate uses firewall rules to reduce accidental leaks.
The first firewall goal is simple:
Client DNS must go to 10.10.10.1, not directly to outside DNS servers.
| Interface | Role |
|---|---|
ens33 |
outside VMware NAT |
ens37 |
inside GhostGate LAN |
These rules block forwarded DNS traffic from the Client VM to any destination other than the router DNS address.
On the Router VM:
sudo iptables -I FORWARD 1 -i ens37 -p udp --dport 53 ! -d 10.10.10.1 -j DROP
sudo iptables -I FORWARD 2 -i ens37 -p tcp --dport 53 ! -d 10.10.10.1 -j DROPSave:
sudo netfilter-persistent saveOn the Client VM:
ping -c 3 google.com
getent ahostsv4 doubleclick.netExpected:
google.com resolves
doubleclick.net returns 0.0.0.0
On the Client VM:
dig @8.8.8.8 google.comExpected after the firewall rule:
connection timed out
DNS through GhostGate should still work:
dig @10.10.10.1 google.com