Blocking nslookup on A record

Question

Need to know which port to be blocked in my local machine so that the nslookup on A record doesnot work? To know the above i need to understand how the lookup on A record how does the request go from the local machine (port) to the nameservers/ rootservers?

For example: C:> nslookup -type=a google.com

Server: MyDslModem.local.lan Address: 192.168.1.1

Non-authoritative answer: Name: google.com Address: 209.85.231.104

Here which from which local port from the local machine does the lookup starts from?

Answer 1

You'll get a better answer if you tell us why you'd want to do this.

DNS traffic uses UDP port 53, but if you want to block that, why not just remove the DNS server configuration from your network adapter?

Answer 2

Outgoing network requests are dynamic and network address translation on your router will use the available high ports. When it leaves your network (192.168.1.0/24) your router will use NAT to assign an available dynamic port to service the outgoing request.

That aside, if you want to prevent a host record lookup from succeeding you can either just put a false record and ip address in your local host file or map it to a false address on your local DNS server before it gets forwarded out.

Answer 3

You can edit the local hosts file to point specific names to 127.0.0.1 to prevent access.

This works because (in most cases) the lookup will check the local hosts file before the DNS servers - and if a value is returned it won't look any further.

However, verifying this using nslookup on Windows won't work, as nslookup queries the nameserver (hence the name). You can check using ping on the hostname - ping does a normal lookup.