I know that we can add any kind of DNS records in BIND DNS server using nsupdate. Can we whitelist or blacklist any ip in realtime using nsupdate. We whitelist only certain IPs to prevent our DNS server from being used as open resolver.
2 Answers
Being an open resolver isn't a bad thing automatically, though nobody particularly cares so long as your server is rate limited to prevent abuse in a DNS Amplification attack. In any case, if you're restricting this, you use the allow-recursion {}
directive in the options
clause of the configuration file. Within that block, just add your internal IPs, don't forget the loopback IP for the server running BIND. The default setting is to allow recursion from everyone.
To restrict what IPs can send updates via nsupdate
you can use the allow-update
directive. By default the server allows updates from any IP, and each zone allows updates from none. You can change this within the global options
clause or within each zone individually. This option can also take ACLs, and Keys to allow/deny updates (it's generally a good idea to allow updates by Key only).
-
I want to whitelist some new elastic IP in AWS in real time using nsupdate. Can we do that ? If yes, can you please give some example. Feb 7, 2014 at 21:46
-
No, you can't change the running configuration without a reload. See the comment about keys.– Chris SFeb 7, 2014 at 21:50
-
But we can add and delete any kind of DNS records using nsupdate without reload. en.wikipedia.org/wiki/Nsupdate Feb 7, 2014 at 21:52
-
-
Can I whitelist/blacklist an IP also dynamically using nsupdate ? This is my question Feb 8, 2014 at 4:59
nsupdate
only gives you the ability to modify records in zones on your server, it does not allow you to change the configuration and updating ACLs is a config change. (See RFC 2136)