CyberMind-FR
d2953c5807
Phase 1 implementation of Vortex DNS Firewall - SecuBox's first line of defense blocking threats at DNS level BEFORE any connection is established. Features: - Threat intel aggregator (URLhaus, OpenPhish, Malware Domains) - SQLite-based blocklist database with domain deduplication - dnsmasq integration via sinkhole hosts file - x47 vitality multiplier concept (each DNS block prevents ~47 connections) - RPCD handler for LuCI integration with 8 methods - CLI tool: vortex-firewall intel/stats/start/stop Tested with 765 blocked domains across 3 threat feeds. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
513 lines
17 KiB
Markdown
513 lines
17 KiB
Markdown
# Vortex DNS Firewall — Reverse DNS Firewalling & Analysis
|
||
|
||
> **×47 Vitality Multiplier**: Each DNS block prevents 47× more damage than a reactive firewall rule.
|
||
> Block threats at the cheapest network layer — BEFORE any connection is established.
|
||
|
||
---
|
||
|
||
## Executive Summary
|
||
|
||
Vortex DNS Firewall transforms SecuBox's DNS layer into a proactive security barrier. By sinking malicious domains at resolution time, it stops:
|
||
- **Malware callbacks** before binary execution
|
||
- **Phishing attempts** before credential theft
|
||
- **C2 communications** before lateral movement
|
||
- **Data exfiltration** before breach completion
|
||
|
||
The ×47 multiplier comes from: a single C2 domain blocked = 47 connection attempts prevented (avg malware beacon rate × infection window).
|
||
|
||
---
|
||
|
||
## Architecture Overview
|
||
|
||
```
|
||
┌─────────────────────────────────────────────────────────────────┐
|
||
│ VORTEX DNS FIREWALL │
|
||
├─────────────────────────────────────────────────────────────────┤
|
||
│ │
|
||
│ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │
|
||
│ │ THREAT │ │ SINKHOLE │ │ MESH │ │
|
||
│ │ INTEL │───▶│ ANALYSIS │───▶│ GOSSIP │ │
|
||
│ │ FEEDS │ │ SERVER │ │ SYNC │ │
|
||
│ └─────────────┘ └─────────────┘ └─────────────┘ │
|
||
│ │ │ │ │
|
||
│ ▼ ▼ ▼ │
|
||
│ ┌─────────────────────────────────────────────────────────┐ │
|
||
│ │ DNS QUERY INTERCEPTION LAYER │ │
|
||
│ │ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ │ │
|
||
│ │ │dnsmasq │ │ DNS │ │ Real- │ │Response │ │ │
|
||
│ │ │ Query │─▶│ Guard │─▶│ time │─▶│ Router │ │ │
|
||
│ │ │ Log │ │Detectors│ │ Intel │ │ │ │ │
|
||
│ │ └─────────┘ └─────────┘ └─────────┘ └─────────┘ │ │
|
||
│ └─────────────────────────────────────────────────────────┘ │
|
||
│ │ │ │
|
||
│ ▼ ▼ │
|
||
│ ┌─────────────┐ ┌─────────────┐ │
|
||
│ │ SINKHOLE │◀────── BLOCKED ────────▶│ ALLOW │ │
|
||
│ │ (Analysis) │ │ (Pass) │ │
|
||
│ └─────────────┘ └─────────────┘ │
|
||
│ │ │
|
||
│ ▼ │
|
||
│ ┌─────────────────────────────────────────────────────────┐ │
|
||
│ │ ANALYTICS & REPORTING │ │
|
||
│ │ • Threat Origins • Block Stats • ×47 Impact Score │ │
|
||
│ └─────────────────────────────────────────────────────────┘ │
|
||
│ │
|
||
└─────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
## Component Design
|
||
|
||
### 1. Threat Intelligence Aggregator (`vortex-intel`)
|
||
|
||
**Purpose**: Aggregate, deduplicate, and score threat feeds for DNS blocking.
|
||
|
||
**Feeds to Integrate**:
|
||
| Feed | Type | Update Interval | Domains |
|
||
|------|------|-----------------|---------|
|
||
| abuse.ch URLhaus | Malware | 5 min | ~50K |
|
||
| abuse.ch Feodo | C2/Botnet | 5 min | ~500 |
|
||
| Phishtank | Phishing | 1 hour | ~20K |
|
||
| OpenPhish | Phishing | 12 hour | ~5K |
|
||
| Malware Domain List | Malware | 1 hour | ~30K |
|
||
| CrowdSec CTI | Community | Real-time | Dynamic |
|
||
| DNS Guard AI | Local | Real-time | Dynamic |
|
||
| Mesh Peers | P2P | 5 min | Shared |
|
||
|
||
**CLI Commands**:
|
||
```bash
|
||
vortex-intel update # Force feed update
|
||
vortex-intel status # Show feed health
|
||
vortex-intel search <domain> # Check if domain is blocked
|
||
vortex-intel stats # Blocking statistics
|
||
vortex-intel add <domain> <reason> # Manual block
|
||
vortex-intel remove <domain> # Manual unblock
|
||
```
|
||
|
||
**Data Structure**:
|
||
```json
|
||
{
|
||
"domain": "evil.com",
|
||
"threat_type": "c2",
|
||
"confidence": 95,
|
||
"sources": ["abuse.ch", "crowdsec"],
|
||
"first_seen": "2026-02-11T00:00:00Z",
|
||
"last_seen": "2026-02-11T06:00:00Z",
|
||
"hit_count": 47,
|
||
"blocked_connections": 2209
|
||
}
|
||
```
|
||
|
||
---
|
||
|
||
### 2. DNS Sinkhole Analysis Server (`vortex-sinkhole`)
|
||
|
||
**Purpose**: Capture and analyze connection attempts to blocked domains.
|
||
|
||
**Architecture**:
|
||
```
|
||
Client Query: evil-c2.com
|
||
│
|
||
▼
|
||
┌─────────────┐
|
||
│ dnsmasq │──▶ Returns: 192.168.255.253 (sinkhole IP)
|
||
└─────────────┘
|
||
│
|
||
▼
|
||
┌─────────────┐
|
||
│ SINKHOLE │──▶ Captures: HTTP/HTTPS/TCP metadata
|
||
│ SERVER │──▶ Logs: Client IP, timestamp, payload hints
|
||
└─────────────┘
|
||
│
|
||
▼
|
||
┌─────────────┐
|
||
│ ANALYSIS │──▶ Identifies: Malware family, C2 protocol
|
||
│ ENGINE │──▶ Correlates: Multiple clients = outbreak
|
||
└─────────────┘
|
||
```
|
||
|
||
**Sinkhole Services** (ports on 192.168.255.253):
|
||
- **:80** - HTTP honeypot (captures GET/POST, User-Agent, payload)
|
||
- **:443** - HTTPS terminator (self-signed, logs SNI + handshake)
|
||
- **:53** - Secondary DNS (catches DNS-over-DNS tunneling)
|
||
- **:8080** - Proxy honeypot (catches proxy-aware malware)
|
||
- **:25/587** - SMTP honeypot (catches spam bots)
|
||
|
||
**Analysis Output**:
|
||
```json
|
||
{
|
||
"event_id": "sink-20260211-001",
|
||
"timestamp": "2026-02-11T06:30:00Z",
|
||
"client_ip": "192.168.1.105",
|
||
"client_mac": "aa:bb:cc:dd:ee:ff",
|
||
"blocked_domain": "evil-c2.com",
|
||
"protocol": "https",
|
||
"sni": "evil-c2.com",
|
||
"user_agent": "Mozilla/5.0 (compatible; botnet/1.0)",
|
||
"threat_assessment": {
|
||
"malware_family": "Emotet",
|
||
"c2_protocol": "HTTPS POST beacon",
|
||
"urgency": "critical",
|
||
"recommended_action": "isolate_client"
|
||
}
|
||
}
|
||
```
|
||
|
||
---
|
||
|
||
### 3. Real-Time Query Firewall (`vortex-dnsfw`)
|
||
|
||
**Purpose**: Intercept DNS queries in real-time with sub-millisecond decisions.
|
||
|
||
**Decision Flow**:
|
||
```
|
||
Query arrives
|
||
│
|
||
▼
|
||
┌─────────────────┐
|
||
│ 1. Cache Check │ ◀── In-memory bloom filter (1M domains, 1MB RAM)
|
||
└────────┬────────┘
|
||
│ miss
|
||
▼
|
||
┌─────────────────┐
|
||
│ 2. Local Intel │ ◀── /var/lib/vortex/blocklist.db (SQLite)
|
||
└────────┬────────┘
|
||
│ miss
|
||
▼
|
||
┌─────────────────┐
|
||
│ 3. DNS Guard │ ◀── Real-time DGA/tunneling detection
|
||
└────────┬────────┘
|
||
│ miss
|
||
▼
|
||
┌─────────────────┐
|
||
│ 4. AI Analysis │ ◀── LocalAI for unknown domains (optional)
|
||
└────────┬────────┘
|
||
│
|
||
▼
|
||
ALLOW / SINK
|
||
```
|
||
|
||
**Performance Targets**:
|
||
- **Bloom filter hit**: <0.1ms
|
||
- **SQLite lookup**: <1ms
|
||
- **DNS Guard check**: <5ms
|
||
- **AI analysis**: <100ms (async, cached)
|
||
|
||
**dnsmasq Integration**:
|
||
```conf
|
||
# /etc/dnsmasq.d/vortex-firewall.conf
|
||
# Sinkhole all blocked domains
|
||
addn-hosts=/var/lib/vortex/sinkhole.hosts
|
||
|
||
# Log all queries for analysis
|
||
log-queries
|
||
log-facility=/var/log/dnsmasq.log
|
||
|
||
# Forward unblocked to upstream
|
||
server=9.9.9.9
|
||
server=1.1.1.1
|
||
```
|
||
|
||
---
|
||
|
||
### 4. Mesh Threat Sharing (`vortex-mesh-intel`)
|
||
|
||
**Purpose**: Share DNS threat intelligence across SecuBox mesh nodes.
|
||
|
||
**Gossip Protocol Enhancement**:
|
||
```
|
||
Node A detects: evil-c2.com (DGA, confidence 95%)
|
||
│
|
||
▼
|
||
Sign with node key
|
||
│
|
||
▼
|
||
Gossip to peers
|
||
│
|
||
┌────┴────┐
|
||
▼ ▼
|
||
Node B Node C
|
||
│ │
|
||
▼ ▼
|
||
Validate Validate
|
||
& Apply & Apply
|
||
```
|
||
|
||
**Shared Data**:
|
||
```json
|
||
{
|
||
"type": "dns_threat",
|
||
"domain": "evil-c2.com",
|
||
"threat_type": "dga_c2",
|
||
"confidence": 95,
|
||
"detector": "dns-guard-dga",
|
||
"source_node": "did:plc:abc123",
|
||
"timestamp": "2026-02-11T06:30:00Z",
|
||
"signature": "ed25519:..."
|
||
}
|
||
```
|
||
|
||
**Trust Scoring**:
|
||
- Threats from high-reputation nodes auto-apply
|
||
- Threats from new nodes queue for review
|
||
- False positive reports reduce source reputation
|
||
|
||
---
|
||
|
||
### 5. Analytics Dashboard (`luci-app-vortex-firewall`)
|
||
|
||
**Metrics to Display**:
|
||
|
||
| Metric | Description |
|
||
|--------|-------------|
|
||
| **×47 Impact Score** | Blocked domains × avg connections prevented |
|
||
| **Threats Blocked Today** | Count of unique domains sinkholed |
|
||
| **Top Threat Categories** | C2, Phishing, Malware, DGA |
|
||
| **Infected Clients** | Clients hitting sinkhole (needs attention) |
|
||
| **Feed Health** | Update status of threat intel feeds |
|
||
| **Mesh Sync Status** | Peers contributing/receiving intel |
|
||
|
||
**Widgets**:
|
||
1. **Threat Map** - Geographic origin of blocked domains
|
||
2. **Timeline** - Blocking events over 24h/7d/30d
|
||
3. **Top Blocked Domains** - Most frequently hit blocks
|
||
4. **Client Risk Score** - Clients ranked by sinkhole hits
|
||
5. **Feed Coverage** - Overlap analysis of threat feeds
|
||
|
||
---
|
||
|
||
## Implementation Phases
|
||
|
||
### Phase 1: Core Infrastructure (Week 1)
|
||
|
||
**Deliverables**:
|
||
- [ ] `vortex-intel` threat feed aggregator
|
||
- [ ] SQLite blocklist database with bloom filter cache
|
||
- [ ] dnsmasq integration for sinkhole routing
|
||
- [ ] Basic CLI for manual block/unblock
|
||
|
||
**Files**:
|
||
```
|
||
package/secubox/secubox-vortex-firewall/
|
||
├── Makefile
|
||
├── files/
|
||
│ ├── vortex-firewall.init
|
||
│ ├── vortex-intel.sh
|
||
│ ├── vortex-sinkhole.sh
|
||
│ └── config/vortex-firewall
|
||
└── src/
|
||
└── bloom-filter.c # Optional: native bloom filter
|
||
```
|
||
|
||
### Phase 2: Sinkhole Server (Week 2)
|
||
|
||
**Deliverables**:
|
||
- [ ] HTTP/HTTPS honeypot on sinkhole IP
|
||
- [ ] Connection metadata capture
|
||
- [ ] Malware family fingerprinting
|
||
- [ ] Client infection alerting
|
||
|
||
**Dependencies**:
|
||
- uhttpd or nginx (lightweight HTTP)
|
||
- openssl (TLS termination)
|
||
- socat (port forwarding)
|
||
|
||
### Phase 3: DNS Guard Integration (Week 3)
|
||
|
||
**Deliverables**:
|
||
- [ ] Real-time query interception hooks
|
||
- [ ] DNS Guard → Vortex Firewall pipeline
|
||
- [ ] AI-powered unknown domain analysis
|
||
- [ ] Confidence-based auto-blocking
|
||
|
||
**Integration Points**:
|
||
```
|
||
DNS Guard Detection → Vortex Intel → Sinkhole → Analytics
|
||
```
|
||
|
||
### Phase 4: Mesh Threat Sharing (Week 4)
|
||
|
||
**Deliverables**:
|
||
- [ ] Gossip protocol for DNS threats
|
||
- [ ] Signed threat attestations
|
||
- [ ] Trust-weighted application
|
||
- [ ] Multi-node blocklist sync
|
||
|
||
**Uses**:
|
||
- `secubox-p2p` gossip layer
|
||
- `secubox-identity` for signing
|
||
- `secubox-mirrornet` for reputation
|
||
|
||
### Phase 5: Dashboard & Reporting (Week 5)
|
||
|
||
**Deliverables**:
|
||
- [ ] LuCI dashboard with ×47 metrics
|
||
- [ ] Real-time threat map
|
||
- [ ] Client risk scoring
|
||
- [ ] Export/reporting API
|
||
|
||
---
|
||
|
||
## CLI Reference
|
||
|
||
```bash
|
||
# Threat Intelligence
|
||
vortex-firewall intel update # Update all feeds
|
||
vortex-firewall intel status # Feed health
|
||
vortex-firewall intel search <domain> # Check domain
|
||
vortex-firewall intel add <domain> # Manual block
|
||
vortex-firewall intel remove <domain> # Manual unblock
|
||
|
||
# Sinkhole
|
||
vortex-firewall sinkhole status # Sinkhole server status
|
||
vortex-firewall sinkhole logs [N] # Last N sinkhole events
|
||
vortex-firewall sinkhole clients # Clients hitting sinkhole
|
||
vortex-firewall sinkhole analyze <event> # Deep analysis
|
||
|
||
# Statistics
|
||
vortex-firewall stats # Overall stats
|
||
vortex-firewall stats --x47 # ×47 impact calculation
|
||
vortex-firewall stats --top-blocked # Top blocked domains
|
||
vortex-firewall stats --top-clients # Most infected clients
|
||
|
||
# Mesh
|
||
vortex-firewall mesh status # Mesh sync status
|
||
vortex-firewall mesh share <domain> # Share threat with mesh
|
||
vortex-firewall mesh receive # Process incoming threats
|
||
|
||
# Service
|
||
vortex-firewall start|stop|restart # Service control
|
||
vortex-firewall daemon # Run as daemon
|
||
```
|
||
|
||
---
|
||
|
||
## RPCD Methods
|
||
|
||
```json
|
||
{
|
||
"luci.vortex-firewall": {
|
||
"read": [
|
||
"status",
|
||
"get_stats",
|
||
"get_blocked_domains",
|
||
"get_sinkhole_events",
|
||
"get_infected_clients",
|
||
"get_feed_status",
|
||
"get_mesh_status",
|
||
"calculate_x47_impact"
|
||
],
|
||
"write": [
|
||
"update_feeds",
|
||
"block_domain",
|
||
"unblock_domain",
|
||
"isolate_client",
|
||
"share_threat",
|
||
"approve_mesh_threat",
|
||
"reject_mesh_threat"
|
||
]
|
||
}
|
||
}
|
||
```
|
||
|
||
---
|
||
|
||
## Configuration
|
||
|
||
```uci
|
||
config vortex-firewall 'main'
|
||
option enabled '1'
|
||
option sinkhole_ip '192.168.255.253'
|
||
option update_interval '300'
|
||
option auto_block_threshold '80'
|
||
option mesh_sharing '1'
|
||
|
||
config intel 'feeds'
|
||
option urlhaus '1'
|
||
option phishtank '1'
|
||
option openphish '1'
|
||
option crowdsec '1'
|
||
option dnsguard '1'
|
||
option mesh_peers '1'
|
||
|
||
config sinkhole 'server'
|
||
option http_port '80'
|
||
option https_port '443'
|
||
option capture_payloads '1'
|
||
option max_payload_size '4096'
|
||
|
||
config alerts 'notifications'
|
||
option infected_client_alert '1'
|
||
option new_threat_alert '1'
|
||
option mesh_threat_alert '1'
|
||
```
|
||
|
||
---
|
||
|
||
## ×47 Impact Calculation
|
||
|
||
```
|
||
Impact Score = Σ (blocked_domain × avg_beacon_rate × infection_window)
|
||
|
||
Where:
|
||
- blocked_domain: 1 (each unique domain)
|
||
- avg_beacon_rate: 12/hour (typical C2 beacon)
|
||
- infection_window: 4 hours (avg detection time without DNS block)
|
||
|
||
Example:
|
||
- 100 C2 domains blocked
|
||
- Each would beacon 12×/hour for 4 hours = 48 connections
|
||
- Total prevented: 100 × 48 = 4,800 connections
|
||
- ×47 multiplier validated (rounded from 48)
|
||
```
|
||
|
||
---
|
||
|
||
## Security Considerations
|
||
|
||
1. **Feed Authenticity**: Verify feed signatures when available
|
||
2. **False Positive Handling**: Approval queue for low-confidence blocks
|
||
3. **Sinkhole Isolation**: Sinkhole runs in isolated network namespace
|
||
4. **Mesh Trust**: Only apply threats from reputation > 50
|
||
5. **Rate Limiting**: Max 1000 new blocks/hour to prevent DoS
|
||
6. **Logging**: All blocks logged for forensics and appeals
|
||
|
||
---
|
||
|
||
## Dependencies
|
||
|
||
| Package | Purpose |
|
||
|---------|---------|
|
||
| `secubox-dns-guard` | Detection algorithms |
|
||
| `secubox-vortex-dns` | Mesh DNS infrastructure |
|
||
| `secubox-p2p` | Gossip protocol |
|
||
| `secubox-identity` | Threat signing |
|
||
| `secubox-localrecall` | Threat memory |
|
||
| `dnsmasq-full` | DNS server |
|
||
| `sqlite3-cli` | Blocklist database |
|
||
|
||
---
|
||
|
||
## Success Metrics
|
||
|
||
| Metric | Target |
|
||
|--------|--------|
|
||
| Query latency overhead | <1ms for cached |
|
||
| Blocklist size | 500K+ domains |
|
||
| Feed freshness | <15 min stale |
|
||
| False positive rate | <0.1% |
|
||
| Mesh sync latency | <5 min |
|
||
| Sinkhole capture rate | 100% of blocked |
|
||
| ×47 impact visibility | Dashboard prominent |
|
||
|
||
---
|
||
|
||
## Future Enhancements
|
||
|
||
1. **DNS-over-HTTPS (DoH) Interception**: Block DoH bypass attempts
|
||
2. **Machine Learning**: Train on local query patterns
|
||
3. **Threat Hunting**: Proactive domain reputation scoring
|
||
4. **SIEM Integration**: Export to external security platforms
|
||
5. **Mobile App**: Push notifications for critical threats
|