0

I know that we can add any kind of DNS records in BIND DNS server using nsupdate. Can we whitelist or blacklist any ip in realtime using nsupdate. We whitelist only certain IPs to prevent our DNS server from being used as open resolver.

2 Answers 2

1

Being an open resolver isn't a bad thing automatically, though nobody particularly cares so long as your server is rate limited to prevent abuse in a DNS Amplification attack. In any case, if you're restricting this, you use the allow-recursion {} directive in the options clause of the configuration file. Within that block, just add your internal IPs, don't forget the loopback IP for the server running BIND. The default setting is to allow recursion from everyone.

To restrict what IPs can send updates via nsupdate you can use the allow-update directive. By default the server allows updates from any IP, and each zone allows updates from none. You can change this within the global options clause or within each zone individually. This option can also take ACLs, and Keys to allow/deny updates (it's generally a good idea to allow updates by Key only).

8
  • I want to whitelist some new elastic IP in AWS in real time using nsupdate. Can we do that ? If yes, can you please give some example. Feb 7, 2014 at 21:46
  • No, you can't change the running configuration without a reload. See the comment about keys.
    – Chris S
    Feb 7, 2014 at 21:50
  • But we can add and delete any kind of DNS records using nsupdate without reload. en.wikipedia.org/wiki/Nsupdate Feb 7, 2014 at 21:52
  • Yes, nsupdate can add or delete any record in a dynamic zone.
    – Chris S
    Feb 8, 2014 at 3:01
  • Can I whitelist/blacklist an IP also dynamically using nsupdate ? This is my question Feb 8, 2014 at 4:59
1

nsupdate only gives you the ability to modify records in zones on your server, it does not allow you to change the configuration and updating ACLs is a config change. (See RFC 2136)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .