yarrick / iodine Goto Github PK
View Code? Open in Web Editor NEWOfficial git repo for iodine dns tunnel
Home Page: https://code.kryo.se/iodine
License: ISC License
Official git repo for iodine dns tunnel
Home Page: https://code.kryo.se/iodine
License: ISC License
Hello!
I launched iodined like this:
# ./iodined -f -c -P pass 10.46.34.1 ovca.ml -p 2053 -n MYIPADDRESS
ALERT! Other dns servers expect you to run on port 53.
You must manually forward port 53 to port 2053 for things to work.
Opened dns0
Setting IP of dns0 to 10.46.34.1
Setting MTU of dns0 to 1130
Opened IPv4 UDP socket
Opened IPv6 UDP socket
Listening to dns for domain ovca.ml
and then issued a dig command like this:
$ dig ovca.ml -t NS @127.0.0.1 -p 2053
; <<>> DiG 9.11.5-P4-5.1+deb10u1-Debian <<>> ovca.ml -t NS @127.0.0.1 -p 2053
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48883
;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; QUESTION SECTION:
;ovca.ml. IN NS
;; ANSWER SECTION:
ovca.ml. 3600 IN NS ns.ovca.ml.
;; ADDITIONAL SECTION:
ns.ovca.ml. 3600 IN A 2.0.0.0
;; Query time: 0 msec
;; SERVER: 127.0.0.1#2053(127.0.0.1)
;; WHEN: Wed Jul 22 23:48:56 CEST 2020
;; MSG SIZE rcvd: 58
As far as I understand, instead of 2.0.0.0, the iodined dns server should respond with MYIPADDRESS. What's wrong and is this a bug?
Hi, i recently tried to use iodine to do tcp over dns and i got Failed to set IP and MTU in client
ip: 169.254.110.0 <--- i used this ip in server instead off 10.0.0.1
didn't work :/ why .??
i'm using windows and tap driver is installed
Hi dear Friend I see this in CLI and tunnel is down
iodine: No downstream data received in 60 seconds, shutting down
How solve this ???
Hello,
am I the only one who cannot get raw mode working on macOS / iOS?
Same setup, a linux and even a windows box can connect to raw socket but macos says test failed and goes through DNS queries (with a huge performance penalty).
It's curious to see that a linux VM running on my macbook can make the socket connection, while once again the host cannot.
Is there any limitation in place by Apple or maybe it's just about setting up the socket in a different way?
I'm sorry I cannot help you with the code but I can be a tester here 😁
Hi,
command on server
sudo iodined -f -c -P PRIVATE10.1.1.1 iodine.adridoesthings.com
command on client (windows)
iodine.exe -f -P PRIVATE iodine.adridoesthings.com
My problem is that the client tell me this:
Opening device \\.\Global\{E7A18040-6E0C-49E0-BE8C-5B9B1D47FC34}.tap
Opened UDP socket
Opened UDP socket
Opened UDP socket
You use protocol v 0x0063ed54, server uses v 0x00000000. Giving up
The server doesn't print anything out after it's startet up.
This is the DNS response (got with wireshark):
I hope you can help me.
Hi,
I am using 0.7.0 from iodine, the host is a quite powerful aarch64 machine running Fedora and its not on the same network, not even so close (within EU borders, but in two different countries), but I get an average ping of 48 ms without the tunnel which is quite decent. Raw mode is disabled and lazy mode is enabled.
I am getting speeds of ~20 kbit/s and that's where it caps out. I tried lowering the -m
value which didn't help much, but made it even slower. I was thinking it could be the bottleneck of the DNS resolver, but I can reproduce the same issue using 1.1.1.1 or any other public resolver from my unrestricted gigabit home network.
I also tried running dnsperf and hammered my DNS resolver with 10k reqs over 10 seconds and they all went thru except like 16 reqs. I was trying to request the same thing what iodine tried as well, a single TXT query. I can see that the network interface is actually under good use and there is around 4 Mb/s traffic on it. If I try running iodine and the benchmark at the same time, the benchmark seems to run fine with also not many failed reqs, however iodine is slow as usual.
In the stdout output I am seeing some SERVFAIL: server failed or recursion timeout and NXDOIMAIN: domain doesn't exist errors from time to time.
Can I do something about these? Seemingly I don't get as many errors from iodine if its in legacy mode, but then its even slower.
Thank you so much
On the server:
sudo iodined -f 172.16.0.0 freumh.org
On the client:
$ sudo iodine -f -r 1.1.1.1 freumh.org
Enter password:
Opened dns0
Opened IPv4 UDP socket
Sending DNS queries for freumh.org to 1.1.1.1
Autodetecting DNS query type (use -T to override).
Using DNS type NULL queries
Version ok, both using protocol v 0x00000502. You are user #2
Setting IP of dns0 to 172.16.0.3
Setting MTU of dns0 to 1130
Server tunnel IP is 172.16.0.0
Skipping raw mode
Using EDNS0 extension
Switching upstream to codec Base128
Server switched upstream to codec Base128
No alternative downstream codec available, using default (Raw)
Switching to lazy mode for low-latency
Server switched to lazy mode
Autoprobing max downstream fragment size... (skip with -m fragsize)
768 ok.. ...1152 not ok.. ...960 not ok.. ...864 not ok.. ..816 ok.. .840 ok.. .852 ok.. will use 852-2=850
Setting downstream fragment size to max 850...
Connection setup complete, transmitting data.
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Hmm, that's 1. Your data should still go through...
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Hmm, that's 2. Your data should still go through...
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Hmm, that's 3. Your data should still go through...
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Hmm, that's 4. Your data should still go through...
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: I think 5 is too many. Setting interval to 1 to hopefully reduce SERVFAILs. But just ignore them if data still comes through. (Use -I1 next time on this network.)
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
^C%
Trying -c
on the server:
$ sudo iodined -c -f 172.16.0.0 freumh.org
On the client resulted in:
$ sudo iodine -f -r 1.1.1.1 freumh.org
Enter password:
Opened dns0
Opened IPv4 UDP socket
Sending DNS queries for freumh.org to 1.1.1.1
Autodetecting DNS query type (use -T to override).
Using DNS type NULL queries
Version ok, both using protocol v 0x00000502. You are user #2
Setting IP of dns0 to 172.16.0.3
Setting MTU of dns0 to 1130
Server tunnel IP is 172.16.0.0
Skipping raw mode
Using EDNS0 extension
Switching upstream to codec Base128
Server switched upstream to codec Base128
No alternative downstream codec available, using default (Raw)
Switching to lazy mode for low-latency
Server switched to lazy mode
Autoprobing max downstream fragment size... (skip with -m fragsize)
768 ok.. ...1152 not ok.. ...960 not ok.. ...864 not ok.. ..816 ok.. .840 ok.. .852 ok.. will use 852-2=850
Setting downstream fragment size to max 850...
Connection setup complete, transmitting data.
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Hmm, that's 1. Your data should still go through...
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Hmm, that's 2. Your data should still go through...
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Hmm, that's 3. Your data should still go through...
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Hmm, that's 4. Your data should still go through...
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: I think 5 is too many. Setting interval to 1 to hopefully reduce SERVFAILs. But just ignore them if data still comes through. (Use -I1 next time on this network.)
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
^C%
Trying -I1
:
$ sudo iodine -f -r 1.1.1.1 freumh.org -I1
Enter password:
Opened dns0
Opened IPv4 UDP socket
Sending DNS queries for freumh.org to 1.1.1.1
Autodetecting DNS query type (use -T to override).
Using DNS type NULL queries
Version ok, both using protocol v 0x00000502. You are user #0
Setting IP of dns0 to 172.16.0.1
Setting MTU of dns0 to 1130
Server tunnel IP is 172.16.0.0
Skipping raw mode
Using EDNS0 extension
Switching upstream to codec Base128
Server switched upstream to codec Base128
No alternative downstream codec available, using default (Raw)
Switching to lazy mode for low-latency
Server switched to lazy mode
Autoprobing max downstream fragment size... (skip with -m fragsize)
...768 not ok.. ..384 ok.. ...576 not ok.. 480 ok.. 528 ok.. ...552 not ok.. ...540 not ok.. will use 528-2=526
Setting downstream fragment size to max 526...
Connection setup complete, transmitting data.
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
iodine: Got SERVFAIL as reply: server failed or recursion timeout
^C%
Some pings but through, but had up to 10 seconds of delay:
ping 172.16.0.0
PING 172.16.0.0 (172.16.0.0) 56(84) bytes of data.
64 bytes from 172.16.0.0: icmp_seq=6 ttl=64 time=10158 ms
64 bytes from 172.16.0.0: icmp_seq=12 ttl=64 time=7088 ms
64 bytes from 172.16.0.0: icmp_seq=16 ttl=64 time=3065 ms
64 bytes from 172.16.0.0: icmp_seq=25 ttl=64 time=74.3 ms
64 bytes from 172.16.0.0: icmp_seq=29 ttl=64 time=5059 ms
64 bytes from 172.16.0.0: icmp_seq=34 ttl=64 time=7180 ms
64 bytes from 172.16.0.0: icmp_seq=41 ttl=64 time=74.5 ms
I think Cloudflare's timeouts are too aggressive.
Can you elaborate on the '-t' option? What is it for and why does it work even on an empty directory (non-bootstrapped)?
Thanks
I encountered an issue with the systemd service failing to start and then failing to restart too fast. It appears that systemd, by default, attempts 5 times to restart and then quits. After the following changes I was able to get iodined.service to start up. (A little digging showed that my server needed 7 failures... just over the 5 that systemd permits by default.)
Here is the Unit file I got to work:
[Unit]
Description=A daemon for tunneling traffic over DNS queries
After=local-fs.target network.target systemd-tmpfiles-setup.service
Documentation=man:iodined(8)
[Service]
EnvironmentFile=/etc/default/iodine
ExecStart=/usr/sbin/iodined -f -u iodine -t /var/run/iodine $IODINED_ARGS -P ${IODINED_PASSWORD}
StartLimitIntervalSec=120
StartLimitBurst=120
Restart=on-failure
Type=simple
[Install]
WantedBy=multi-user.target
The only real difference is the StartLimit* lines. I think the only one that matters is the StartLimitBurst one but I've left both in there since it works consistently.
If it matters, I'm in a VM of Ubuntu 20.04 Desktop (gnome) with no modifications (basically a bare bones Ubuntu desktop install).
Excuse me, I found a DNS just connect by importing a simple address like Google DNS, cloud flare DNS it can import on a router.
Mobile, pc...
There's 3 questions:
Can your DNS be work similar dns in up
If (question in top = true)
Q1={How can I config this(your DNS) in my vps }
Type (Q1)
Else:
Q2={how can I config similar first DNS I typed in top}
Q1.List.append{Q2}
Type (Q1)
Excuse me for bad English .
Thanks for your help and time from now.
And it's can be very better if you create a simple setup script because everyone can use it
Ex.
From the client side, if I send a DNS query like this
dig @8.8.8.8 vaaaakaxhiu.mysubdomain.com
will be blocked, while this query
dig @8.8.8.8 abcdefghijk.mysubdomain.com
I spent tons of time finding out about this issue.
Just record in case other people encounter this issue
I launch iodined
like this:
./iodined -DD -n <my public IP> -f 10.100.99.1 -c -P 0930100010 b.mysubdomain.com
Debug level 2 enabled, will stay in foreground.
Add more -D switches to set higher debug level.
iodined: IPv6 not supported, skipping
Opened dns0
Setting IP of dns0 to 10.100.99.1
Setting MTU of dns0 to 1130
Opened IPv4 UDP socket
Listening to dns for domain b.mysubdomain.com
RX: client 173.194.93.2, type 1, name abcdefghijk.b.mysubdomain.com
TX: client 173.194.93.2, type 1, name abcdefghijk.b.mysubdomain.com, 5 bytes data
Subject says it all:
getaddrinfo() returns positive values in case of errors. These get returned
to the caller:
res = getaddrinfo(host, portnum, &hints, &addr);
if (res == 0) {
int addrlen = addr->ai_addrlen;
/* Grab first result */
memcpy(out, addr->ai_addr, addr->ai_addrlen);
freeaddrinfo(addr);
return addrlen;
}
return res;
But the caller check for negative values, e.g.:
res = get_addr("resolver1.opendns.com", 53, AF_INET, 0, &query.destination);
if (res < 0) return 1;
...
dns4addr_len = get_addr(listen_ip4, port, AF_INET, AI_PASSIVE, &dns4addr);
if (dns4addr_len < 0) {
...
int addr6_res = get_addr(listen_ip6, port, AF_INET6, AI_PASSIVE, &dns6addr);
if (addr6_res < 0) {
Hello there,
I recently have setup iodine similarly to situation 1 from the description in the readme. The performance was not the best but worked out for most of my needs - as always. I usually use a SSH Tunnel from iodine-client to iodine-server with the -D
socks tunnel option, but this time I changed it up a bit.
I also have a VPN-client from nordvpn with sockd running on the server. So I passed -L7777:[sockd_Listening_IP]:port
instead of -D7777
to the ssh command - just forwarding the traffic to the remote sockd on the server side instead of using the builtin socks proxy. The speed difference is truly amazing. I tested it at 30-40 MBit/s up- and download speed.
I verified it several times and the speed seemed to be limited only by the connection speed of my VPN provider. The documentation on the project site states, that speed should be limited at 1MBit/s, so now I'm wondering, if this is normal behaviour or special circumstance.
iodine is running properly on the server end and I've verified the tunnel is running by using https://code.kryo.se/iodine/check-it/
the client is able to connect to the tunnel but unable to ping it
iodined.c:61:11: fatal error: systemd/sd-daemon.h: No such file or directory
61 | # include <systemd/sd-daemon.h>
| ^~~~~~~~~~~~~~~~~~~~~
Patches are welcome..
Hello.
I'd like to build a small fleet of highly available (hehe) iodined using several domain names, would it be possible to let iodined support more than one top domain names at the same time? Or even better if it will just work with any top domain names regardless of what they are.
Thank you.
sudo ./bin/iodine -f xxxxx xxxxx
Enter tunnel password:
No tun devices found, trying utun
iodine: open_utun: connect: Resource busy
Opened utun1
Opened IPv4 UDP socket
Sending DNS queries for xxxxx to xxxxxx
Autodetecting DNS query type (use -T to override).
Using DNS type NULL queries
Version ok, both using protocol v 0x00000502. You are user #1
Setting IP of utun1 to 10.0.0.3
Adding route 10.0.0.0/27 to 10.0.0.3
add net 10.0.0.0: gateway 10.0.0.3
Setting MTU of utun1 to 1130
Server tunnel IP is 10.0.0.1
Requesting server address to attempt raw UDP mode (skip with -r)
Server is at xxxxx, trying raw login: (skip with -r) ....failed
and the code:
Lines 1489 to 1520 in dc307b7
But I could not understand the semantic of "raw UDP login"
Would you mind explaining it in the README?
Hi, Yarrick:
My iodine server is centos7, currently running iodine and squid services normally, the server's virtual network card IP address is 172.16.255.254; The Win7 client installs the openvpn virtual network card and sets the browser proxy to 172.16.255.254:3128, the web page can be opened normally, and can watch 1080p video smoothly. Win7 client test ping 172.16.255.254 successfully, the average delay is about 150ms.
I currently encounter a problem as follows:
This iodine server and Win7 iodine client are very slow to transmit data through the virtual network card, FTP transfers about 60MB of data, it takes at least 1 hour.
What direction should this problem be investigated?
I'm trying to connect two linux machine via dns tunneling. I've setup duckdns
dynamic dns subdomain i.e. crappyhorse.duckdns.org on the server machine, and i also registered a free domain name at freenom
with the current dns configuration. The command i issue at the server is
$ sudo iodined -f -c -P justphrase 192.168.99.1 t.vodafonegenericavail.cf
Opened dns0
Setting IP of dns0 to 192.168.1.7
Setting MTU of dns0 to 1130
Opened IPv4 UDP socket
Listening to dns for domain t.vodafonegenericavail.cf
$ sudo iodine -f -P justphrase t.vodafonegenericavail.cf
Opened dns0
Opened IPv4 UDP socket
Sending DNS queries for t.vodafonegenericavail.cf to 127.0.0.53
Autodetecting DNS query type (use -T to override).iodine: Got NOTIMP as reply: server does not support our request
.iodine: Got NXDOMAIN as reply: domain does not exist
.iodine: Got NXDOMAIN as reply: domain does not exist
.iodine: Got NXDOMAIN as reply: domain does not exist
.iodine: Got NXDOMAIN as reply: domain does not exist
.iodine: Got NXDOMAIN as reply: domain does not exist
.iodine: Got NXDOMAIN as reply: domain does not exist
.iodine: Got NOTIMP as reply: server does not support our request
.iodine: Got NXDOMAIN as reply: domain does not exist
.iodine: Got NXDOMAIN as reply: domain does not exist
.iodine: Got NXDOMAIN as reply: domain does not exist
.iodine: Got NXDOMAIN as reply: domain does not exist
.iodine: Got NXDOMAIN as reply: domain does not exist
.iodine: Got NXDOMAIN as reply: domain does not exist
.iodine: Got NOTIMP as reply: server does not support our request
.iodine: Got NXDOMAIN as reply: domain does not exist
.iodine: Got NXDOMAIN as reply: domain does not exist
.iodine: Got NXDOMAIN as reply: domain does not exist
.iodine: Got NXDOMAIN as reply: domain does not exist
.iodine: Got NXDOMAIN as reply: domain does not exist
.iodine: Got NXDOMAIN as reply: domain does not exist
iodine: No suitable DNS query type found. Are you connected to a network?
iodine: If you expect very long roundtrip delays, use -T explicitly.
iodine: (Also, connecting to an "ancient" version of iodined won't work.)
$ dig t.vodafonegenericavail.cf
; <<>> DiG 9.16.1-Ubuntu <<>> t.vodafonegenericavail.cf
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27729
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;t.vodafonegenericavail.cf. IN A
;; ANSWER SECTION:
t.vodafonegenericavail.cf. 3600 IN CNAME dnsrecord.vodafonegenericavail.cf.
dnsrecord.vodafonegenericavail.cf. 3599 IN CNAME crappyhorse.duckdns.org.
crappyhorse.duckdns.org. 59 IN A 41.36.193.3
;; Query time: 219 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Tue Mar 15 15:02:53 EET 2022
;; MSG SIZE rcvd: 131
The output of https://code.kryo.se/iodine
Troubleshoot your iodine setup
Analyzing DNS setup for tunnel domain 't.vodafonegenericavail.cf'... (might take some time)
Looking for nameserver for vodafonegenericavail.cf.. got ns04.freenom.com (at 104.155.29.241).
Resolving delegation of t.vodafonegenericavail.cf at 104.155.29.241... not known.
Error: The tunnel name t.vodafonegenericavail.cf is not delegated to any host according to nameserver ns04.freenom.com.
I'm currently incapable of getting my head around what's the culprit of the problem or wrong with this setup. Any ideas ?
Hello, I've tried using iodine on MacOS Catalina and I'm getting a segfault error:
kbs@touchbar:~/git/iodine$ /usr/local/sbin/iodine -f -P pelado tunnel.peladonerd.com
iodine: Run as root and you'll be happy.
kbs@touchbar:~/git/iodine$ sudo /usr/local/sbin/iodine -f -P pelado tunnel.peladonerd.com
Segmentation fault: 11
The installation steps went well:
kbs@touchbar:~/git/iodine$ make
OS is DARWIN, arch is x86_64
kbs@touchbar:~/git/iodine$ make install
OS is DARWIN, arch is x86_64
mkdir -p /usr/local/sbin
install bin/iodine /usr/local/sbin/iodine
chmod 755 /usr/local/sbin/iodine
install bin/iodined /usr/local/sbin/iodined
chmod 755 /usr/local/sbin/iodined
mkdir -p /usr/local/share/man/man8
install man/iodine.8 /usr/local/share/man/man8/iodine.8
chmod 644 /usr/local/share/man/man8/iodine.8
mkdir -p /usr/local/share/doc/iodine
install README.md /usr/local/share/doc/iodine/README.md
chmod 644 /usr/local/share/doc/iodine/README.md
Any ideas?
Hello,
I tried to setup iodine, everything seems working. However when I try to check what domains are coming to the server, they all appear to be in binary format. I've started the client to not run in binary format. I'd like to know if it is possible to make the client query domains which container only ascii characters allowed in the domain name? I've tried using -O
with different encoding but still in tcpdump I saw binary domains like so:
zwchaA0123456789M-<M-=M->[email protected]
Command to start the client:
iodine -r -f -P password 111.111.111.111 t.iodine.com
Hi, I'm more than anything just having some fun learning about this stuff. But I'm wondering if it's at all possible to choose which interface this uses. My reasoning is that en0 is wired ethernet and I'd like to connect to a wifi signal and have a connection available just as an "in case" the main internet goes down.
I see the following error on Mac OS X 10.15.6. Does iodine support Mac OS X? Thanks.
$ sudo ./iodined -f 10.0.0.1 test.com
Enter password:
iodined: open_tun: Failed to open tunneling device: No such file or directory
Hi Dear I run iodine tunnel on ubuntu 18.0.4 Tunnel Establish and have ping interface of tunnel
Nat ip range in iodine server and route to client side
in client donnot have ping by ip range route t the client
please help me
I'm using Samsung S10, Android 12, Termux (latest from f-droid)
This is what I get when I make:
make[1]: Entering directory '/data/data/com.termux/files/home/iodine/src'
OS is LINUX, arch is aarch64
CC common.c
common.c:61:12: error: static declaration of 'daemon' follows non-static declaration
static int daemon(int nochdir, int noclose)
^
/data/data/com.termux/files/usr/include/unistd.h:343:5: note: previous declaration is here
int daemon(int __no_chdir, int __no_close);
Is the problem that it thinks OS is LINUX, rather than ANDROID?
Hi,
If anyone sees this, I am curious if the connection password is sent encrypted or hashed in any way. I realize the actual data inside the tunnel is not, but I am worried that if the connection password is viewable, my Iodine server will get connections from other people.
Thank you!
I see a small mention about brew in a yaml file and an old brew package elsewhere on the internet. But has anyone looked at making a recent iodine recipie for brew?
I haven’t created any brew packages before so if nobody else is, I wouldn’t mind creating one for iodine.
Hello.
Given the systemd
(or a similar system manager) is available, it should be possible to run iodined
with very restricted privileges and on behalf of a non-root user (even a dynamically generated one), granting additional capabilities via AmbientCapabilities=
. Hence, unconditional panic in check_superuser()
should be avoided. So, instead of calling check_superuser()
, at least on Linux, there should be a check against required capability (there's libcap-ng
for this). For creating a tun device it'd be CAP_NET_ADMIN
, for binding on port 53 it's CAP_NET_BIND_SERVICE
, for changing the user it is CAP_SETUID
and CAP_SETGID
.
Thanks.
Hi, I'm on MacOS 11.4 (Big Sur) (M1) and I can't compile iodine.
I get the following error:
iodine % make
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
/bin/sh: line 0: cd: src: No such file or directory
^Cmake[47]: *** [all] Interrupt: 2
make[46]: *** [all] Error 130
make[45]: *** [all] Error 130
make[44]: *** [all] Error 130
make[43]: *** [all] Error 130
make[42]: *** [all] Error 130
make[41]: *** [all] Error 130
make[40]: *** [all] Error 130
make[39]: *** [all] Error 130
make[38]: *** [all] Error 130
make[37]: *** [all] Error 130
make[36]: *** [all] Error 130
make[35]: *** [all] Error 130
make[34]: *** [all] Error 130
make[33]: *** [all] Error 130
make[32]: *** [all] Error 130
make[31]: *** [all] Error 130
make[30]: *** [all] Error 130
make[29]: *** [all] Error 130
make[28]: *** [all] Error 130
make[27]: *** [all] Error 130
make[26]: *** [all] Error 130
make[25]: *** [all] Error 130
make[24]: *** [all] Error 130
make[23]: *** [all] Error 130
make[22]: *** [all] Error 130
make[21]: *** [all] Error 130
make[20]: *** [all] Error 130
make[19]: *** [all] Error 130
make[18]: *** [all] Error 130
make[17]: *** [all] Error 130
make[16]: *** [all] Error 130
make[15]: *** [all] Error 130
make[14]: *** [all] Error 130
make[13]: *** [all] Error 130
make[12]: *** [all] Error 130
make[11]: *** [all] Error 130
make[10]: *** [all] Error 130
make[9]: *** [all] Error 130
make[8]: *** [all] Error 130
make[7]: *** [all] Error 130
make[6]: *** [all] Error 130
make[5]: *** [all] Error 130
make[4]: *** [all] Error 130
make[3]: *** [all] Error 130
make[2]: *** [all] Error 130
make[1]: *** [all] Error 130
make: *** [all] Error 130
I'm not sure where to look for what could be causing the issue.
I see a lot of work put into iodine after the latest 0.7.0 release (which is 7 years ago). iodine commits newer than 0.7.0 release fix opening utunX devices on Darwin. I'd really like the fix to appear on a release.
The latest version is 0.7.0 and was released on 2014-06-16. I see there's been quite a lot of commits since that time.
Does it make sense to bump the version so that the new features gets included in the distributions packaging the project?
iodined: Bad IPv6 address to listen on: '(null)'
I got this issue when trying to run: iodined -f . It returned the error Bad Ipv6 adress to listen on. While trying to find out why i got this issue, i commented out the if statement that is responsible for returning this error. I got the following error: socket: Address family not supported by protocol.
I' m afraid it might have something to do with the configuration of my VPS, but I have no idea what would cause it. If anyone can help with this, that would be great :)
Just stumbled across this project and thought it was really cool! The only downside seems to be the throughput, but I understand the reasoning behind it (not wanting to affect intermediate DNS servers that we don't own). I wonder, though, would it be possible to speed up the throughput of the DNS tunnel by setting the client's DNS resolver to be the server running iodined?
In my mind, it would be some sort of additional flag where we set a static IP (e.g. --iodined X.X.X.X
). If there was a way to attempt this with the client, we could send the DNS packets directly to our server as fast as we want.
I'm probably making a lot of incorrect assumptions here because I am super new to this project and idea, but I thought I'd throw the thought out there and see what others think.
Hi,
May this report may not be useful but I noticed that using iodine crash my kde setup (xorg stays alive), also i noticed that some fuse file system are not responding anymore, dmesg does not say much... sorry i don´t have more information to share.
But I can replicate some steps if mentored.
Regards
@yarrick MacOS prior to released version of 10.6 does not have net/if_utun.h
. The header itself in 10.6.8 is trivial though; perhaps, it can be checked in configure
and it not detected, we can add required defines from 10.6.8 version?
:info:build make: Entering directory `/opt/local/var/macports/build/_opt_PPCSnowLeopardPorts_net_iodine/iodine/work/iodine-0.8.0'
:info:build make[1]: Entering directory `/opt/local/var/macports/build/_opt_PPCSnowLeopardPorts_net_iodine/iodine/work/iodine-0.8.0/src'
:info:build CC tun.c
:info:build CC read.c
:info:build CC dns.c
:info:build CC encoding.c
:info:build CC login.c
:info:build OS is DARWIN, arch is Power Macintosh
:info:build CC base32.c
:info:build tun.c:34:25: error: net/if_utun.h: No such file or directory
:info:build CC base64.c
:info:build tun.c: In function ‘open_utun’:
:info:build tun.c:377: error: ‘UTUN_CONTROL_NAME’ undeclared (first use in this function)
:info:build tun.c:377: error: (Each undeclared identifier is reported only once
:info:build tun.c:377: error: for each function it appears in.)
:info:build tun.c:406: error: ‘UTUN_OPT_IFNAME’ undeclared (first use in this function)
:info:build Making base64u.c
:info:build CC base128.c
:info:build make[1]: *** [tun.o] Error 1
:info:build make[1]: *** Waiting for unfinished jobs....
This is on 10a190 build of 10.6. I borrowed the header from 10.6.8 SDK, and build worked fine then.
I'm trying to run iodine as follows:
sudo ./iodine -f -P password t1.mydomain.com
However, I get:
No tun devices found, trying utun
[1] 4469 segmentation fault sudo ./iodine -f -P password t1.mydomain.com
This happens regardless of specifying -d=utun0
(all the way through utun7
, only utun0
through utun6
are shown on my ifconfig
). There aren't any /dev/tunX
or /dev/utunX
devices showing in /dev
, though I am not sure whether they should be or not.
This is using the latest master
commit as of May 12th 2021 on Mac OS X Big Sur 11.3.
Tunnelblick seems to be able to create a new utun7
no problem when it creates an OVPN connection.
If the client only has IPv4 available, and the server has both IPv4 and IPv6, raw login can be attempted on IPv6 anyway if the DNS servers in use prefer it.
It works this way since the server does not always know its addresses (if listen addresses are not set). The server should respond with addresses for both protocols (guessing its address if required) to allow the client to try either one.
$ sudo ./bin/iodine -f4 dns.tun
Enter tunnel password:
Opened dns0
Opened IPv4 UDP socket
Sending DNS queries for dns.tun to 127.0.0.53
Autodetecting DNS query type (use -T to override).iodine: ..
Using DNS type TXT queries
Version ok, both using protocol v 0x00000502. You are user #1
Setting IP of dns0 to 10.4.5.3
Setting MTU of dns0 to 1130
Server tunnel IP is 10.4.5.1
Requesting server address to attempt raw UDP mode (skip with -r)
Server is at 2001:db8::1, trying raw login: (skip with -r) ....failed
Iodine is not compatible with TAP 9.0.0.21 on Windows 10
File: tap0901.sys
Version: 9.0.0.21
Productversion: 9.21.1 9/21
Connection between client-server gets established without any error message BUT ping from client to server is not working (and vice-versa). Tunnel is not working.
Reason for connection issue/ not working tunnel is not visible.
( It is working with TAP version 9.0.0.9)
Hello, I just found out that my LTE operator passes DNS requests with ~30kbytes/s, and I think this is not the limit.
I found android package AndIodine, but I can't find any servers, I know maybe it's nerve-wracking question, but since I don't have any knowledge on Linux could you create a place for devs to contribute their iodine configurations for community?
Thanks, also you could reach me at nuzzle[at]duck.com
I'm running iodine daemon on OpenWRT (Linux 4.14)
Having a dynamic WAN IP, I'd find it great if iodined could listen on any IP, but only on a specific interface (WAN).
The current way of binding to 0.0.0.0 on any interface messes with my other DNS services.
Obviously I should (and will continue to try to) get a script hooked on an IP change on the WAN interface, that would then restart iodioned with the new address in the -l parameter (but apparently I'm too stupid for that).
Hi! The source code tries to resolve external IP of server by using API of api.externalip.net which is no longer available. It is no problem to replace it with another service's URL. But why do it at all? Why can't we use DNS to find out NS record responsible for the given domain and then retrive A record for it? I cannot figure out the case where external IP doesn't match the IP in A-record for the nameserver. Do you?
The Windows OpenVPN installer (OpenVPN-2.5.6-I601-amd64.msi) now creates a TAP interface with a root-enumerated hardware ID (ComponentId = root\tap0901). Iodine (tun.c) only looks for legacy hardware IDs (e.g. ComponentId = tap0901), even if a device name is provided (-d).
Please update the registry device enumeration section to match: tap0801, tap0901, and root\tap0901.
Also: there are several malformed warnx statements in tun.c.
e.g.: warnx("Error opening registry key " TAP_ADAPTER_KEY);
should be: warnx("Error (%d) opening registry key: %s", status, TAP_ADAPTER_KEY);
I'm trying to bring up an iodine tunnel from a client through a vanilla-configured cache running on Fedora 36. The cache config file is:
# /etc/named/named.conf
options {
listen-on port 53 { any; };
allow-query { any; };
recursion yes;
dnssec-validation no;
querylog yes;
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
I'm starting the server using
iodined -P foobar 192.168.14.1 -DD -f test.com
and the client using
iodine -r -P foobar test.com
The symptom I'm observing is that the cache introduces a huge (around 5 second) delay into the forwarding of some of the client-generated queries (e.g. raacdMAj...
, which I think are part of the downstream path fragment size negotiation).
What I'm seeing is that the client gives up on progressively smaller attempted downstream path fragment sizes, until it fails entirely. A few seconds later, the cache starts sending a bunch of the wrongfully-delayed client-generated queries to the server, which immediately replies to them, and the cache then logs them as query failed (timed out)
in its /var/named/data/named.run
log file.
This all used to work perfectly well back when Fedora used named-9.11.*
, and building the old rpm packages of named-9.11
for Fedora-36 and downgrading to them there gets it working perfectly well, so I suspect the problem is a bug (or weird new configuration default) in bind-9.16.*
.
I understand this does not appear to be a problem with iodine itself, but rather with bind-9.16.*
, but figured if anyone would know or care, or notice the problem, they'd be more likely to be found here than on some Fedora or bind-9 mailing list :)
Any clue on what might be going on much appreciated -- thanks!
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.