DNS Tunneling with OSTP (Native dnstt)

OSTP natively implements the dnstt (DNS Tunnel) protocol. This allows you to encapsulate encrypted OSTP traffic inside standard DNS queries (TXT and NULL records), which can bypass restrictive firewalls or captive portals that only allow UDP port 53.

Unlike other tools, you do not need to install a standalone dnstt-server or dnstt-client. The OSTP server has a built-in dnstt listener, and the client natively encodes payloads.

Prerequisites

A domain name (e.g., yourdomain.com).
You need to configure NS records to delegate a sub-domain to your server's IP address.

Step 1: DNS Setup

Go to your domain registrar's DNS panel.
Create an A record pointing to your server's IP address:
- Type: A
- Name: tunsrv
- Value: YOUR_SERVER_IP
Create an NS record delegating the tunneling sub-domain to that A record:
- Type: NS
- Name: t
- Value: tunsrv.yourdomain.com

This means any DNS query for *.t.yourdomain.com will be sent directly to your server!

Step 2: Generate Keys

DNS Tunneling uses its own Ed25519 keypair to prevent abuse. You must generate a pubkey/privkey pair (using the dnstt-server -gen-key tool or OSTP API).

Step 3: Server Configuration

Add the dns inbound to your server's config.json. The server must run with sufficient privileges to bind to port 53 (e.g., using sudo setcap 'cap_net_bind_service=+ep' /path/to/ostp).

{
  "mode": "server",
  "inbounds": [
    // Your normal OSTP listener
    {
      "type": "ostp",
      "tag": "ostp-in",
      "listen": "0.0.0.0",
      "port": 50000,
      "access_keys": ["YOUR_SECRET_KEY"]
    },
    // The native dnstt listener
    {
      "type": "dns",
      "tag": "dns-in",
      "listen": "0.0.0.0:53",
      "domain": "t.yourdomain.com",
      "pubkey": "YOUR_PUBKEY_HERE",
      "privkey": "YOUR_PRIVKEY_HERE"
    }
  ],
  "outbounds": [
    { "type": "direct", "tag": "direct" }
  ]
}

Step 4: Client Configuration

On the client, configure your ostp outbound to use the dns transport. You must specify the exact domain, a public resolver (like 1.1.1.1 or 8.8.8.8), and the server's public key.

"outbounds": [
  {
    "type": "ostp",
    "tag": "proxy",
    "server": "YOUR_SERVER_IP", // Used for logical routing
    "port": 50000,
    "access_key": "YOUR_SECRET_KEY",
    "transport": {
      "type": "dns",
      "domain": "t.yourdomain.com",
      "resolver": "1.1.1.1",
      "pubkey": "YOUR_PUBKEY_HERE"
    }
  }
]

Security Considerations

Because OSTP traffic does not look like standard DNS queries (the TXT records contain high-entropy base32 noise), advanced DPI systems might flag it as an anomaly if they inspect the contents of DNS TXT records. However, for bypassing captive portals (hotel Wi-Fi, airplane Wi-Fi) or simple firewalls, it is incredibly effective.

OSTP Wiki

English

Русский