# DNS and IPv6 Protection

NetGuard enforces complete network protocol containment to eliminate silent data leakage outside Tor circuits.

---

# DNS Interception Architecture

Standard operating systems frequently leak unencrypted DNS requests to local DHCP resolvers or ISP servers. NetGuard prevents this by enforcing the following nftables rules:

1. UDP Port 53 Interception: All outbound UDP packets addressed to port 53 are redirected to Tor DNSPort (127.0.0.1:5353).
2. TCP DNS / DoT Blockade: Direct TCP connections to port 53 and port 853 (DNS-over-TLS) are explicitly dropped fail-closed.
3. Bootstrap DNS Authorization: Outbound direct DNS is permitted solely for the dedicated Tor user (UID 43) during initial bridge resolution.

---

# IPv6 Fail-Closed Parity

Many VPNs and privacy tools suffer from IPv6 leaks when local networks assign dual-stack addresses.

In Snigdha OS Decentralized:

• The table inet snigdha ruleset operates uniformly across IPv4 and IPv6.
• IPv6 TCP traffic is redirected to Tor IPv6 TransPort ([::1]:9040).
• IPv6 DNS queries are redirected to Tor IPv6 DNSPort ([::1]:5353).
• All other IPv6 traffic is dropped at the kernel filter hook.