iodine

The software creates an IPv4 tunnel that carries traffic inside DNS queries and responses, allowing network communication when only DNS is permitted. It runs a server component that binds to a domain’s sub‑domain and a client that connects to that domain, establishing a virtual TUN interface that presents an internal IP network to both sides. Once the tunnel is active, the client can use a SOCKS5 proxy listener to forward arbitrary IPv4 connections through the DNS channel.

It is intended for users who need to bypass restrictive firewalls or captive portals that block all traffic except DNS, and for administrators who want a lightweight, self‑hosted method of providing remote network access. The tool supports up to sixteen concurrent users per server and automatically negotiates packet sizes for optimal downstream throughput.

The implementation is portable across Linux, macOS, theBSD, NetBSD, OpenBSD and Windows, and it uses the DNS NULL record type to embed up to a kilobyte of compressed payload per reply, offering higher performance than many other DNS tunneling solutions. Authentication is performed via an MD5‑based challenge‑response, and the program is released under the ISC license as free, open‑source software.