Even if you could, the problem would come when you wanted to establish a data connection with the remote end. Assuming "except for DNS traffic" actually means "except for packets on the well-known port for DNS" then you are going to be restricted to sending packets with destination port 53. This means that for comms to work, the remote end is going to have to be able to receive packets on port 53. Some kinds of network setups may allow this -- all of this stuff ends up being hideously dependent on the detail -- but many won't.
It certainty depends on how the network is doing the packet scanning and the other measures in place. If the security measures include a allow list of DNS servers, then there's little that can be done to bypass it.
TCP over DNS has been a thing for a long time, though I guess it's fallen out of favour because "real" VPNs are so easily available nowadays.
For example you can see here:
Re:How Nat Traversal Works
by Hikikomori on Thursday August 03, 2023 @01:25PM
(#36988905)
Smarter firewalls can filter not just ports but the payload as well.
There are all sorts of tunnel-thru-DNS possibilities (e.g. iodine, heyoka, etc.). There also a number of ways to mitigate (e.g. limit destination DNS servers, traffic analysis to spot anomalous 'queries', etc.). It's an arms race.
Any modern enterprise firewall has app identification built in and will quickly identify you trying to send non dns traffic. And after the solarwinds debacle, everyone with a security team is looking for it.
Re:How Nat Traversal Works
by commandlinefan on Thursday August 03, 2023 @03:39PM
(#36990719)
Well, there'd be no way for a firewall to block a request like:
dig -b peername data.data.data.data
And let the "name server" on the other end listening on port 53 parse the data. You _would_ have to be able to listen on port 53 and of course it would be slow as hell, but it's unblockable.
Re:How Nat Traversal Works
by JackGreyhat on Thursday August 03, 2023 @05:53PM
(#36992527)
Check this:
https://www.paloaltonetworks.com/cyberpedia/what-is-dns-tunn...
See the "Preventing DNS Tunneling" chapter.
Re:How Nat Traversal Works
by commandlinefan on Friday August 04, 2023 @09:54AM
(#37000075)
Interesting, thanks. Seems like the firewall would have to be specifically configured to block, say "WebRTC through DNS tunneling" in this case, though.
I'm not familiar with DNS at all, but can't you craft UDP packets that look like DNS packets, but contain a useful payload with which you can do the whole STUN/UDP-hole-punching/p2p dance, assuming you have matching that can unwrap the payload?