Hide TeamSpeak IP using DNS

[tomsk]

Hello,

I would like to hide my real server's IP using DNS (I have domain).

I read somewhere that I should set SRV record, at the moment I use Cloudflare.


I already have A record with name "ts" which points to real IP (unsecure), so I would like to hide it.

There are screenshots of DNS setup:





SRV's target is set to A record with name "ts" which points to real IP (mentioned above) as you can see.

But it doesn't work, I just cannot connect to speak.mydomain.com

[Bluscream]

Domains are a convinience- not a security-feature. It is being used to make connecting easier and it won't hide anything.

Also cloudflare's "protection" does not work with teamspeak because teamspeak uses udp and cloudflare only proxies tcp. You can use cloudflare for teamspeak but only with protection disabled for that record.

[tomsk]

I am not asking about DDoS protection, I am asking about SRV record, it doesn't matter if it is Cloudflare, or if it is UDP.

[Chris]

TeamSpeak 3 SRV records are: _ts3._udp.yourdomain.tld
So you have to change _teamspeak to _ts3 (or maybe even ts3, depending on whether or not cloudflare tries to be smart(er than it should be)).

[tomsk]

TeamSpeak 3 SRV records are: _ts3._udp.yourdomain.tld
So you have to change _teamspeak to _ts3 (or maybe even ts3, depending on whether or not cloudflare tries to be smart(er than it should be)).

And how does SRV record work with TeamSpeak? I thought, that Service name can be whatever what I want.

So I need to have A record for connecting to my server via IP.

And I link that SRV record to that A record right? What is point? Cannot users then determine real IP?

[Chris]

So I need to have A record for connecting to my server via IP.

And I link that SRV record to that A record right?

yes, that is how SRV records work. You link something to an A record which links it to an IP.

What is point? Cannot users then determine real IP?

Of course they can, they will always be able to. The user needs to connect to the server, users will always be able to ask their operating system about their current connections and it'll tell them. As such they'll always be able to figure out the IP addresses they're connecting to.

As for the point, SRV records allow multiple services running on different servers to be accessible from the same domain. You can have multiple SRV records for different services on example.com, even if these services run on different systems because the SRV records links to a (different) DNS name for every service, which then can link to different IP addresses.

[tomsk]

Thank you very much, now I understand.

It looks like that it is impossible to hide real IP.

[numma_cway]

It looks like that it is impossible to hide real IP.

That's what bluscream tried to tell you in his first answer.

I already have A record with name "ts" which points to real IP (unsecure), so I would like to hide it.

You think that there's a relationship between the terms "security" and "obscurity"?

Why isn't this meme known outside germany?

[ANR Daemon]

Thank you very much, now I understand.

It looks like that it is impossible to hide real IP.

All connections in the internet are done via IP address(-es).
DNS is a means to discover that IP address. SRV RR adds capability to also discover ports without prior knowledge.

[tomsk]

I thought that SRV RR could work as proxy, so my bad

Like this:


Isn't there some UDP proxy service?

[Chris]

Even if there is, using that might make every client appear to have to same address as far as the server is concerned. Which would also mean every client has the same flag, and that you won't be able to ban clients IP addresses anymore.

[tomsk]

Yes I understand, maybe that proxy could pass to the server user's real IP, but doesn't pass real server's IP to user.

But it is not TeamSpeak question anymore