Circumventing pay-for-service wifi points

by on Feb.16, 2010, under Posts

Ever want to access the internet without authenticating at your local college? Have you found yourself accessing wifi points at airports that require you to pay ‘X’ amount of dollars for service? Well my cheap friend, I have a solution for you!

I will for warn you, that this method is a bit slow and it does require *nix on both ends. Also this is for educational purposes only!

Firstly, you need an accessible server that is running ssh on it, along with a nifty program called ‘dns2tcp’. There are some other similar programs like iodine and such that can do this for you, but this walk-through is focused on the usage of dns2tcp. Also, you need a DNS name, which you can freely get via or dyndns.



I followed this guide quite closely, and it actually did not end up working for me. The guide suggests to start the daemon via:

sudo /etc/init.d/dns2tcpd start

However, this did not work for me. By using netstat, I found that dns2tcpd was not even listening. Instead, I ended up using ‘/usr/local/bin/dns2tcpd’. But before I continue, I’ll post my dns2tcpd config file:

listen =
port = 53
# If you change this value, also change the USER variable in /etc/default/dns2tcpd
user = nobody
chroot = /tmp
domain =
ressources = ssh:

Change accordingly, and yes, ‘ressources’ is suppose to be misspelled.

Here is the command that has worked for me and I’m currently using to make this post possible:

sudo nohup dns2tcpd -f /etc/dns2tcpd.conf &

Verify that you’ve forwarded a port on your router to port 53 on your server, or if your server is in the DMZ, you shouldn’t have to worry about doing this.

Now, in a remote location that has restricted access (via redirecting every HTTP request to a login page), test that you’re server is visible via DNS by using a command like ‘host’. We’ll use my DNS name for this example:

host has address

If this works, there’s a good chance you’re in business. Then, the next test you want to do is:

dns2tcpc -z
Available connection(s) :

If you see results like this, then chances are, this will work. Next, we need to do some DNS tunneling:

dns2tcpc -l 4444 -r ssh

If dns2tcpc is listening on port 4444, you now should be able to ssh into it and this will redirect you to your home server.

ssh -D 1234 user@localhost -p 4444

Once you’ve authenticated then you’re set to now setup firefox or a browser that supports SOCKS 4/5, to connect to your loopback interface on port 1234.

One big reason why I made mention of this, is because Hak5 had an episode showing how to do basically the same thing but they stated you had to pay for your own DNS service / name. My method works, and it’s also cheaper.

:, , , , ,

9 Comments for this entry

  • Majoux

    “and yes, ‘ressources’ is suppose to be misspelled.”

    No man : it’s a french word !
    The company which create this soft is french :

  • zitstif

    Ah thanks Majoux! 🙂

  • Sebastien Wains

    I reported the typo back then (yes, it’s a typo since the whole config file is in english)
    Recently the dev came back to me telling me about a new release, fixing the typo and other stuff.

    Gotta give it a try when I find some time 🙂

  • dmwong

    Worked great, thank you for this. The Uni that I’m studying at restricts all access unluess you log in. This worked wonders. one question, once you have the service running, with the follwong command sudo nohup dns2tcpd -f /etc/dns2tcpd.conf & how do I then stop it so that Port 53 is no longer listening?


  • zitstif

    You would have to kill the process:

    sudo pkill dns2tcpd

  • Markus

    You will be able to start the server with

    /etc/init.d/dns2tcp start

    if you edit /etc/default/dns2tcp
    and replace

  • zitstif

    Ah! Thank you for your words of wisdom.

  • x-men

    i dont understand the whole concept i need a simple step by step method.Thanks in advance

  • Abulmagd

    First, good job.. Second ,, your method will work fine if port 53 is open, BUT some ISPs redirect all traffic going out to port 53 toward thier own dns server, and in this situation your dns2tcp traffic will not reach your dns2tcp server so you have to play with your dns records.

Leave a Reply

Please leave these two fields as-is:

Looking for something?

Use the form below to search the site:

Still not finding what you're looking for? Drop a comment on a post or contact us so we can take care of it!