Questions tagged [rpz]

Response Policy Zones are a form of DNS firewall that define policy actions within a DNS zone file.

Filter by
Sorted by
Tagged with
0
votes
1answer
45 views

Log category RPZ to syslog in BIND 9

I am running a chrooted BIND 9.11 server on FreeBSD 11.2 that has a RPZ configured. It is currently logging RPZ hits in a file, but I would like to (also) send them to syslog. I can see other log ...
0
votes
1answer
32 views

Wildcards in RPZ (response policy zones)

Is it possible to have wildcards domains in the middle of a domain name using response policy zones? For example s3.*.amazonaws.com. If this is not possible, is there a technology, that can do this?
2
votes
2answers
144 views

'query_getzonedb()failed: Zone Not Loaded' error in DNS logs

While investigating an incident, I noticed an error in my syslog that looks like this (anonymized): Feb 3 21:59:59 ns1 named[18824]: client xxx.xxx.xxx.xxx#2091 (us-east1-aws.api.snapchat.com): view ...
0
votes
2answers
54 views

Get DNS 'Additional section' using Windows (nslookup option?)

I can use dig to get the full master file output of DNS info, and for my problem I am interested in the information in the "additional" section: $ dig example.com ; <<>> DiG 9.9.4-RedHat-...
1
vote
0answers
88 views

Why does my Bind RPZ config work for one host, but not the other (SERVFAIL)

I have some hosts in a DMZ which need to use LDAP resources on the LAN. We don't forward DNS into the LAN, so instead of adding entries in individual /etc/hosts, I decided to try a Bind RPZ zone to ...
1
vote
1answer
246 views

RPZ CNAME leaks usage of RPZ

For history reasons we have both internal (192.168.0.0/16) and public IPs on hosts on one domain (example.com). I now want to split this up so that internal hostnames are not resolved for external ...
2
votes
0answers
195 views

BIND different forwarder based on response ip (rpz-ip)

I have a recursive BIND dns server . forwarders { 8.8.8.8; }; Is it possible to change the forwarder based on respone ip ? For example if the response is 192.168.1.1 then forward/...
4
votes
1answer
2k views

BIND, RPZ and Forwarding priorities

My objective is to block certain domains in bind WITHOUT first looking up their address (this is a small caching bind dns server). Currently my configuration will forward the request for badhost.com ...
1
vote
1answer
415 views

serve the root zone with bind and utilize RPZ

I have some problems with configuring BIND as my private server at root zone. I have tried the dot "." (had read somewhere) and an empty string "" (my bad guess) as for the root zone identifier (...
2
votes
1answer
453 views

Alternative ways to get past 32 rpz zone limit in BIND? …without running BIND a thousand times

Using BIND RPZs gives me exactly what I'm looking for to alter queries. However, my recursive DNS server is in use by hundreds of clients and I am looking for a way to allow each client some level of ...
0
votes
2answers
4k views

With BIND 9 how can I match-clients in multiple views?

BIND appears to be looking at the configuration file from top-down and assigning queries to the first matching view based on match-clients. According to http://www.zytrax.com/books/dns/ch7/view.html ...
1
vote
1answer
717 views

Certificate Errors on “redirection” in DNS RPZ of https/ssl

I've set up a DNS RPZ where I "redirect" users to a walled garden using DNS RPZ records when users try to access a list of bad sites. Let's say a user tries to access badsite.com. The redirection to ...
5
votes
1answer
5k views

Set up BIND9 as DNS Firewall

With OpenDNS now needing one to be on the pro package to have filtering turned on, being on a tight budget, we are in need of free DNS filtering. After reading this link on how to block domains with ...
0
votes
1answer
1k views

Why does nslookup not return what I am expecting from my bind server? (RPZ configured)

Prior to this question I was looking for some help in finding a way to return a different response to querying clients based on their IP Address. The question was answered here: How can I selectively ...
2
votes
2answers
219 views

Can DNS RPZ firewalls protect against IP Access?

I am looking into DNS-RPZ firewalls. Can they protect against users browsing to http://{ip-address}? If so how does that work? Given no name resolution is required?
2
votes
1answer
349 views

How to automatically rewrite response records obtained using recursion in BIND?

I'm using Bind 9.9.4 on a hypervisor (lets call the hypervisor A) for VMs. The hypervisor has a VPN connection to a different host (lets call it B), which also has a public IP. The bind on hypervisor ...