How often are DNS aliases updated for firewall use?
-
We have a pretty nice monitoring service (nodeping.com)
I want to allow their query nodes to perform queries from the outside that normally we would block as being intrusive.I've set up an alias to their DNS that gives the list of IP's.
My question: with that set up, if one of their probe IP's changes, how soon will pfSense see it?
-
@mrpete how exactly are you loading this?
What dns query are you doing, or you just loading the text file they list?
filterdns that would reload a fqdn you have setup in an alias defaults to every 5 minutes.. But that not going to matter the ttl of those records is 18000 seconds or 5 hours. So even if they changed it, you would have the old IP cached for maybe up to 5 hours.. So I take it those IPs don't change very often.
-
@johnpoz Thanks! (And yes, pretty stable ;) )
oh, I am using an alias to "host" probes.nodeping.com
Would it be somehow better to use that name directly in a firewall rule?
-
@mrpete I would think alias is better, since it should fill a table with all of those IPs.
I do same sort of thing for like uptime robot and status cake, and the IPs that plex uses to check services. But I just load all of those lists via pfblocker into an alias. And I have it only set to update ever like 12 hours.. And never ran into any issues..
