0

I have a small network I help admin at a camp. I have OpenDNS set up for filtering purposes on a Windows Server 2008 SBS box. The camp uses a Sonicwall TZ200 firewall.

It has come to my attention that by changing the DNS settings on a device, OpenDNS can be bypassed, and the filtering neutralized.

Do I need to set up a rule in the Sonicwall to force OpenDNS or is there something I'm overlooking in Server 2008 in the DNS setup?

  • 1
    Block port 53 except to OpenDNS's IPs. – ceejayoz Apr 22 '13 at 19:22
3

Just block all outbound 53/udp and 53/tcp traffic except that which is destined to OpenDNS's IP addresses. This is a fairly standard measure taken to not only control content, but also to thwart malware that tries to change systems' DNS settings to point to malicious servers.

  • And that would take place in the Sonicwall, yes? – The Chad Apr 22 '13 at 19:42
  • @TheChad - Yep, that's correct. – EEAA Apr 22 '13 at 19:50
  • Note that your naughty users will always be able to point to VPN using an IP address you haven't blocked or DNS name you haven't filtered, then get full access back. You will be able to significantly raise the skill required to break out, but it's not watertight. – Bracken Apr 22 '13 at 23:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.