Whitelist DNS for specific interface
-
Hello, I need to block DNS resolution for specific interface and resolve only specific domains. Filtration on firewall itself is not enough for our cybersecurity team. Any tips how to proceed? I am using DNS resolver and PfblockerNG - is it possible to make that with them? They offer to use Squid for that. Is that really needed? Thanks.
-
@GeorgeCZ58 said in Whitelist DNS for specific interface:
Filtration on firewall itself is not enough for our cybersecurity team
Because you can filter on a higher level, like the ISP ? Are you sure that is possible ?
Because you can filter on a lower level, like the device itself ? Are you sure that is possible (and is that secure ?) ?
What do you mean by 'not enough' ?
edit
pfBlocker by itself, when you install it, does (blocks) nothing. You have to add IP/network lists, or DNSBL list so it will block these when used.AFAIK, I'm not sure if it can work the other way around :
Pass a domain name (or sub domain) is white-listed.
And then : Block the rest. -
@Gertjan said in Whitelist DNS for specific interface:
@GeorgeCZ58 said in Whitelist DNS for specific interface:
Filtration on firewall itself is not enough for our cybersecurity team
Because you can filter on a higher level, like the ISP ? Are you sure that is possible ?
Because you can filter on a lower level, like the device itself ? Are you sure that is possible (and is that secure ?) ?
What do you mean by 'not enough' ?
edit
pfBlocker by itself, when you install it, does (blocks) nothing. You have to add IP/network lists, or DNSBL list so it will block these when used.AFAIK, I'm not sure if it can work the other way around :
Pass a domain name (or sub domain) is white-listed.
And then : Block the rest.But I need that only for specific Interface(VLAN) for rest I need to use PfblockerNG with only selected lists(to allow internet connection).
-
A rapid Google search gave me this :
https://community.ipfire.org/t/any-way-to-block-all-dns-queries-and-whitelist-some/10544
Btw : and because 'respip' was unknown to me, I found this. So it exists,
Not sure if pfSense has this software component. It is a module created by NLnetLabs (unbound author).So, easy plan A : PI-Hole ?
