Hide server public IP from logs (when domain is proxied)

TeamSpeak Server
1

Hi,

I am using cloudflare as my domain manager. I am taking advantage of their DNS proxy to hide behind them to avoid being DDoS-ed on a given A or CNAME record. Usually this works out of the box for HTTP. In order for other services to work its clients need to support SRV record which teamspeak does support it. However teamspeak exposes my public IP in the clients logs (ctrl+l) - which breaks the concept of this.

For this particular example this is the DNS settings:

;; A Records
example.com.	                1	IN	A	___MY-PUBLIC-IP___

;; SRV Records
_ts3._udp.example.com.	        1	IN	SRV	0 5 9987 example.com.
_tsdns._tcp.example.com.	    1	IN	SRV	0 5 41144 example.com.

This A record has DNS proxy enabled.

Teamspeak clients logs:

6/1/2020 21:49:32	Windows Audio Session	Devel	DeviceDeleteList::wait_for_deletes - enter - DeviceDeleteList	
6/1/2020 21:49:32	Windows Audio Session	Devel	DeviceDeleteList::wait_for_deletes - leave - DeviceDeleteList	
6/1/2020 21:49:32	ClientUI	Info	Connect to server: example.com	
6/1/2020 21:49:32	ClientUI	Info	Trying to resolve example.com	
6/1/2020 21:49:32	TSDNS	Info	A/AAAA DNS resolve successful, "example.com" =(h: 104.24.104.221 p:0)	
6/1/2020 21:49:32	TSDNS	Info	A/AAAA DNS resolve for possible TSDNS successful, "example.com" =(h: 104.24.104.221 p:0)	
6/1/2020 21:49:32	TSDNS	Info	SRV DNS resolve successful, "_tsdns._tcp.example.com" =(h: dc-2c0fc161e8d2.example.com p:41144)	
6/1/2020 21:49:32	TSDNS	Info	SRV DNS resolve successful, "_ts3._udp.example.com" =(h: dc-bec1b4d8da32.example.com p:9987)	
6/1/2020 21:49:32	TSDNS	Info	A/AAAA DNS resolve successful, "dc-bec1b4d8da32.example.com" =(h: ___MY-PUBLIC-IP___ p:0)	
6/1/2020 21:49:32	ClientUI	Info	Lookup finished: ip=___MY-PUBLIC-IP___ port=9987 query=example.com error=0	
6/1/2020 21:49:32	ClientUI	Info	Resolve successful: ___MY-PUBLIC-IP___:9987	
6/1/2020 21:49:32	ClientUI	Info	Initiating connection: ___MY-PUBLIC-IP___:9987	
6/1/2020 21:49:32	Windows Audio Session	Devel	DeviceDeleteList::wait_for_deletes - enter - DeviceDeleteList	
6/1/2020 21:49:32	Windows Audio Session	Devel	DeviceDeleteList::wait_for_deletes - leave - DeviceDeleteList	
6/1/2020 21:49:32	ClientUI	Info	Connect status: Connecting	
6/1/2020 21:49:32	PktHandler	Devel	Puzzle solve time: 6	
6/1/2020 21:49:32	ClientUI	Info	Connect status: Connected	
6/1/2020 21:49:32	ClientUI	Info	Connect status: Establishing connection	
6/1/2020 21:49:32	ClientUI	Info	Connect status: Connection established	
6/1/2020 21:49:34	TSDNS	Info	TSDNS queried unsuccessfully 104.24.104.221:41144	
6/1/2020 21:49:34	TSDNS	Info	No TSDNS found

As you can notice teamspeak exposes my public IP in the logs anyways… which allows attacker to exploit it. I believe this should not be visible on the clients side - only at server’s level…

Thanks, Michal

1 Like
2

Yeah it wont work like that, as far as I’m aware the IP will always be displayed. Even if it was possible to hide it, there are other methods of obtaining it.

3

I have this particular domain completely proxied by Cloudflare and have checked all its resolution and my public IP was not exposed during the resolution process.

NSLOOKUP on A record:

C:\Users\MacGyver>nslookup example.com 1.1.1.1
Server:  one.one.one.one
Address:  1.1.1.1

Non-authoritative answer:
Name:    example.com
Addresses:  2606:4700:3031::6818:68dd
          2606:4700:3030::ac43:a86d
          2606:4700:3031::6818:69dd
          104.24.104.221
          172.67.168.109
          104.24.105.221

NSLOOKUP on both SRV records:

C:\Users\MacGyver>nslookup -q=srv _ts3._udp.example.com 1.1.1.1
Server:  one.one.one.one
Address:  1.1.1.1

Non-authoritative answer:
_ts3._udp.example.com   SRV service location:
          priority       = 0
          weight         = 5
          port           = 9987
          svr hostname   = dc-bec1b4d8da32.example.com

C:\Users\MacGyver>nslookup -q=srv _tsdns._tcp.example.com 1.1.1.1
Server:  one.one.one.one
Address:  1.1.1.1

Non-authoritative answer:
_tsdns._tcp.example.com SRV service location:
          priority       = 0
          weight         = 5
          port           = 41144
          svr hostname   = dc-2c0fc161e8d2.example.com

C:\Users\MacGyver>

So unless teamspeak client wont be snitching my public IP to anybody I should be safe…

Thanks, Michal

4

So I read a little about this problem.
In short: This is possible but costs extra (a lot).
You need Cloudflare Spectrum
image

image
image1210×651 18.1 KB

https://www.cloudflare.com/products/cloudflare-spectrum/

The only other soultion I can think of is by purchasing a small VPS with integrated DDOS protection and installing your own reverse proxy.

5

I agree that there are other ways of getting servers real IP (wireshark the real traffic for example). I just don’t want it to make it so obvious at first glance - via direct resolution or checking logs… usually such attackers are people (kids) with very low knowledge on this topic…

1 Like
6

When you resolve this it will result in the origin IP and not a Cloudflare one. Thus the client receives the origin IP when fully resolving the srv record no matter the Cloudflare proxy.

1 Like
7

Yeah I know… As I mentioned in post above I just don’t wanna have it for them as simple :slight_smile:

8

It would also be useful to hide IP addresses in the server list. I’m getting tired of permanently DDoS attacks.

9

Just in the server list won’t help.
As long as the client connects to the server directly and not through a reverse proxy he will have the server IP no matter what.
Even if he connects to a Nickname and the client would theoretically not show the server address he can still wireshark the connection and find the IP like that.
The only solution is a separate proxy service. There is nothing TeamSpeak can do about this really.

Edit: Though I agree a little more control over the server list entry would be great!

10

Do you talk about single entries or IP addresses from servers?

11

Well I thought the ability to select what gets reported to the server list would be great. Maybe a setting like connection method where you can enter the Domain / IP / Nickname to be displayed in the serverlist.

12

Just recommending to fix some things here… and just to be honest; No server admin in the world wants that User are able to expose their hidden IP addresses, but the weblist won’t avoid it.

Just like said… quite some work.

The address can be hidden into the client protocol and weblist aswell, since it’s just able to hide it in some ways. Maybe not a total solution, but a way to make it stronger.