Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking into DNS-RPZ firewalls.

Can they protect against users browsing to http://{ip-address}?

If so how does that work? Given no name resolution is required?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

I would say "no".

From here :

DNS RPZ will block DNS resolution, machines connecting to the C&C via IP address will not be blocked.

DNS RPZ are here to block DNS resolution to known malicious hosts and sites. In case of an ip address you don't have DNS resolution.

The feature you are looking for can be managed by a WAF (Web Application Firewall).

However, any Reverse Proxy is able to block access based on incorrect Host Header. Here, the ip address will be incorrect Host Header.

share|improve this answer

No, they cannot protect from that.

DNS RPZ shouldn't been used as a tool to enforce access policies.
It's usage is to prevent users from accidentally visiting sites which are harmful.
If a user still wants to visit it and DNS RPZ is your only defense, then it is very simple for them to circumvent that.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.