NAT firewall, auto-add to whitelist triggered by DNS lookup? [closed]

Question

I am interested in setting up a firewall. This is going to include your usual NAT, with port-forwarding for incoming connections.

However I want the outgoing connections to use a whitelist of hostnames. I also want the same device to act as the DNS server that my PCs use so it always knows the latest IP for any hostname on the whitelist when a PC is trying to connect to it.

This can either be Cisco IOS, a recommended alternative, or an actual Illumos or Linux server. I'm thinking that using a server will give me more flexibility, but I'm open to suggestions.

Here's what I want to happen: (outgoing connections, from a user on my network)

1. The user's PC performs a DNS lookup for a given site (i.e. serverfault.com)

2. The firewall server compares this to a whitelist of hostnames, and if it is permitted then the resulting IP addresses are passed back to the PC.

3. If the DNS lookup was allowed, then the IP access list is immediately updated with the most recent results from DNS. (with reasonable expiration)

   • If a PC initiates a connection an arbitrary IP address, which was not listed on any of the approved DNS responses, then arbitrary packets can be refused.

4. (optional, but preferable) sniff the TCP connection to verify the hostname of the HTTP or HTTPS connection. In this way, we can prevent accessing a non-whitelisted site that may exist on a shared, whitelisted IP.

I think that I can accomplish items 1-3 with ipfilter, combined with a custom-written DNS server to handle the whitelist, and trigger the additions to ipfilter. Does this sound reasonable, or will there be inevitable issues with ipfilter not recognizing changes immediately? I'm pretty sure ipfilter will work with a Linux/Illumos NAT.

Is there an application for Linux or Illumos that already does DNS-triggered IP whitelisting? (keeps me from re-inventing the wheel)

I've not heard of IOS running a DNS server. Is there a solution in Cisco IOS that handles this? Is there an obvious solution I should know about, or is this simply an unusual firewall setup?

Answer 1

Per our discussion in the comments, it sounds like you may be confusing the role of a firewall with that of a transparent proxy.

• Firewalls do not rely upon DNS resolution to implement access policies. There are several reasons for this that I have covered before. The most significant reasons are:

  1. Reliance upon an easily spoofed protocol
  2. Added software complexity and non-deterministic functionality from a given input set (what passes the filter today may not be what passes the filter tomorrow)
  3. Effectively delegating management of the firewall policy to a different device and protocol.

• Transparent proxies typically intercept HTTP+DNS traffic, and apply access controls based on the hostnames being requested. The IP address is not a consideration at this layer. If the requested entity does not match an allowed name, an error page is returned directly from the transparent proxy itself without routing the request to the intended resource.

The primary difference is the layer at which these devices operate. Since the transparent proxy only has to concern itself with names, and not the IP addresses that those names resolve to, you don't run into the same logic problems that a firewall does.