iodine

iodine is an open-source server and client application that tunnels IPv4 data through a DNS server. It is designed for environments where internet access is restricted by firewalls that still permit DNS queries, allowing network traffic to bypass these restrictions by encoding it within DNS requests. This makes it a specialized tool for establishing connectivity when standard web or VPN ports are blocked.

The software is deployed as a pair of binaries: iodined for the server and iodine for the client. The server requires a public IP address and control over a domain to delegate a subdomain to the tunnel. Once configured, the server opens a virtual interface, known as a tun device, to handle the encapsulated IPv4 traffic and listens for incoming DNS queries on UDP port 53.

Key features

• Tunneling of IPv4 data via DNS queries
• Automatic detection and switching to raw UDP tunneling when possible
• Support for IPv4 and IPv6 nameservers for connectivity
• Integration with native utun devices on Mac OS X
• DNS request forwarding capabilities on the server side
• Configurable DNS response fragment size to optimize bandwidth
• Password protected tunnel authentication

The architecture relies on the delegation of a subdomain to the iodined server via NS records in a zone file. The client connects by specifying the domain and an optional relaying DNS server, automatically receiving a tunnel IP address close to the server's internal IP. While the software handles the transport of data, the tunneled traffic is not encrypted and can be read by external parties. To ensure privacy, the software is intended to be used as a transport layer for other encrypted protocols, such as SSH or a secondary VPN. The server can also be configured to perform NAT, which enables the routing of all system traffic through the DNS tunnel.

This tool is intended for network administrators and users needing to establish connectivity in highly restricted network environments.