Advanced Listeners#

Beyond HTTP/HTTPS, InfraGuard supports WebSocket, DNS, and MQTT protocol listeners. Each listener applies IP intelligence filtering before proxying traffic upstream, giving the same OPSEC layer that HTTP traffic receives.

WebSocket Listener#

The WebSocket listener proxies bidirectional WebSocket connections to upstream C2 servers. This is required for C2 frameworks that use WebSocket transport (Mythic, PoshC2 websocket mode) and for tunnel tools like Chisel that multiplex over WebSocket.

Configuration#

listeners:
  - protocol: "websocket"
    bind: "0.0.0.0"
    port: 443
    tls:
      cert: "/etc/infraguard/cert.pem"
      key: "/etc/infraguard/key.pem"
    options:
      upstream: "ws://10.0.0.5:8080"

Features#

• Bidirectional proxying: Both text and binary WebSocket frames are forwarded in both directions. Binary frame support is required for Chisel/yamux multiplexed tunnels.
• Subprotocol forwarding: Client-requested subprotocols are forwarded to the upstream server. Chisel requires specific subprotocols for its transport negotiation.
• IP intelligence on upgrade: The client IP is checked against the IP intelligence layer during the HTTP upgrade handshake, before the WebSocket connection is established.
• Event recording: Connection events (upgrade, close, block) are recorded in the tracking database with protocol: "websocket".

Tunnel Tool Support#

For Chisel and Ligolo, the WebSocket listener acts as an opaque byte stream proxy. The tunnel tool’s internal protocol (yamux for Chisel) runs inside WebSocket frames. InfraGuard does not inspect the tunneled content - it only filters at the IP intelligence layer during connection setup.

DNS Listener#

The DNS listener acts as a filtering DNS proxy for DNS-based C2 channels (Cobalt Strike DNS, dnscat2, etc.).

Configuration#

listeners:
  - protocol: "dns"
    bind: "0.0.0.0"
    port: 53
    options:
      upstream: "10.0.0.5:53"
      allowed_query_types:           # only forward these DNS record types
        - "A"
        - "AAAA"
        - "TXT"
        - "CNAME"
        - "MX"
      nxdomain_enumeration_threshold: 50    # NXDOMAIN responses per window
      nxdomain_enumeration_window: 60       # window in seconds

Features#

• Query type filtering: Only configured DNS record types are forwarded upstream. Other types receive NXDOMAIN, reducing the attack surface.
• IP intelligence filtering: Source IPs are checked against the intelligence layer. Known scanner and vendor IPs are blocked.
• NXDOMAIN enumeration detection: Tracks NXDOMAIN responses per source IP. When a client exceeds the threshold within the window, the IP is auto-blocked at the intel layer for cross-protocol coverage - the same IP is blocked on HTTP, WebSocket, and DNS simultaneously.
• asyncio DatagramProtocol: Uses UDP transport directly via asyncio, no third-party DNS libraries required.

NXDOMAIN Enumeration Detection#

DNS reconnaissance tools (fierce, dnsrecon, dnsenum) generate large volumes of NXDOMAIN responses as they brute-force subdomains. The DNS listener detects this pattern:

1. Tracks NXDOMAIN count per source IP in a sliding window
2. When the count exceeds the threshold (default 50 in 60 seconds), the IP is auto-blocked
3. The block is applied at the intel layer, so the IP is blocked across all protocols

MQTT Listener#

The MQTT listener provides IP intelligence filtering for MQTT-based C2 channels.

Configuration#

listeners:
  - protocol: "mqtt"
    bind: "0.0.0.0"
    port: 1883
    options:
      upstream: "mqtt://10.0.0.5:1883"
      allowed_topics:                # optional topic allowlist
        - "c2/commands"
        - "c2/responses"

Requirements#

The MQTT listener requires the aiomqtt package:

pip install infraguard[mqtt-listener]

Features#

• IP intelligence filtering: Client IPs are checked on connection. Blocked IPs have their TCP connection closed immediately.
• TCP proxy: Acts as a transparent TCP proxy between the MQTT client and the upstream broker.
• Event recording: Connection and block events are recorded in the tracking database.

Common Listener Options#

All listener types support these shared configuration options:

listeners:
  - protocol: "..."
    bind: "0.0.0.0"          # bind address (default: 0.0.0.0)
    port: 443                 # listen port
    tls:                      # optional TLS termination
      cert: "/path/cert.pem"
      key: "/path/key.pem"