I am interested in setting up a firewall. This is going to include your usual NAT, with port-forwarding for incoming connections.
However I want the outgoing connections to use a whitelist of hostnames. I also want the same device to act as the DNS server that my PCs use so it always knows the latest IP for any hostname on the whitelist when a PC is trying to connect to it.
This can either be Cisco IOS, a recommended alternative, or an actual Illumos or Linux server. I'm thinking that using a server will give me more flexibility, but I'm open to suggestions.
Here's what I want to happen: (outgoing connections, from a user on my network)
The user's PC performs a DNS lookup for a given site (i.e. serverfault.com)
The firewall server compares this to a whitelist of hostnames, and if it is permitted then the resulting IP addresses are passed back to the PC.
If the DNS lookup was allowed, then the IP access list is immediately updated with the most recent results from DNS. (with reasonable expiration)
- If a PC initiates a connection an arbitrary IP address, which was not listed on any of the approved DNS responses, then arbitrary packets can be refused.
(optional, but preferable) sniff the TCP connection to verify the hostname of the HTTP or HTTPS connection. In this way, we can prevent accessing a non-whitelisted site that may exist on a shared, whitelisted IP.
I think that I can accomplish items 1-3 with ipfilter
, combined with a custom-written DNS server to handle the whitelist, and trigger the additions to ipfilter
. Does this sound reasonable, or will there be inevitable issues with ipfilter
not recognizing changes immediately? I'm pretty sure ipfilter
will work with a Linux/Illumos NAT.
Is there an application for Linux or Illumos that already does DNS-triggered IP whitelisting? (keeps me from re-inventing the wheel)
I've not heard of IOS running a DNS server. Is there a solution in Cisco IOS that handles this? Is there an obvious solution I should know about, or is this simply an unusual firewall setup?
ipfilter
and my own DNS server and then for step 4 I roll my own Packet Filter, but that would be long-term given the level of complexity involved.