BlackholeDNS: Anyone tried it with pfsense?



  • Hey I am wondering if anyone has done a blackhole DNS setup for malware domains such as from www.malwaredomains.com so any DNS requests for them just go to 127.0.0.1 (loopback) so machines don't connect?

    There was an addon for smoothwall which did this http://community.smoothwall.org/forum/viewtopic.php?f=26&t=26030 and it was very useful and is actually the only thing I miss from smoothwall now I am on pfsense. I am just wondering if anyone ever tried an addon or just did it manually using scripts?



  • Would be nice to have an unbound add in to do this.



  • @ipv6kid:

    Would be nice to have an unbound add in to do this.

    it would be wouldnt it :) watch this space for 2.1.



  • @wagonza:

    @ipv6kid:

    Would be nice to have an unbound add in to do this.

    it would be wouldnt it :) watch this space for 2.1.

    Awesome. This paper from the SANs institute may interest you http://www.sans.org/reading_room/whitepapers/dns/dns-sinkhole_33523

    Ideally it would just resolve malware domains from various sources (malware domains, zeus blocklist and whatever else with the option to choose lists) to 127.0.0.1. I would like to see logging about contacted domains or something if it was doable as that was something that the smoothwall addon didn't have which would have proved useful (though the setup stops a lot of driveby downloads, exploit kit sites etc anyway).

    Thanks.



  • A better/preferred solution (IMHO) would be to redirect to an internal page hosted on pfsense explaining why it was rejected just like squidguard. The issue with redirecting to 127.0.0.1 or not responding is they trick your PC into thinking it's going to get something if it goes there, so it will take a long time and then ultimately 'not respond'. This can also sometimes look like something is broken, so if you have a larger network you may get lots of "why isn't this website working" – as opposed to the user seeing and immediately understanding the reason it was blocked was due to alleged spyware and/or malware and it will remove all question. This will also aid in the troubleshooting process, as you would know immediately the reason this or that page is not functioning.

    Just my 2 cents, I highly support the idea though. I wonder if there are "lists" one could subscribe to like with pfblocker. BTW, sites simply being blocked with no explanation why (and system resource hogging) is why I don't use pfblocker.



  • @Kamel:

    A better/preferred solution (IMHO) would be to redirect to an internal page hosted on pfsense explaining why it was rejected just like squidguard. The issue with redirecting to 127.0.0.1 or not responding is they trick your PC into thinking it's going to get something if it goes there, so it will take a long time and then ultimately 'not respond'. This can also sometimes look like something is broken, so if you have a larger network you may get lots of "why isn't this website working" – as opposed to the user seeing and immediately understanding the reason it was blocked was due to alleged spyware and/or malware and it will remove all question. This will also aid in the troubleshooting process, as you would know immediately the reason this or that page is not functioning.

    Just my 2 cents, I highly support the idea though. I wonder if there are "lists" one could subscribe to like with pfblocker. BTW, sites simply being blocked with no explanation why (and system resource hogging) is why I don't use pfblocker.

    Actually a machine connecting to 127.0.0.1 (assuming it doesn't have anything running on HTTP or whatever port and isn't IE going to Bing) is pretty fast. Also redirecting to pfsense would mean non-browser generated traffic from malware would be sent there - I think all malware communications should be kept off the network unless logging and even then at risk because you don't know what it will do). Try putting 127.0.01 into a browser and you will see. Most connections though will be stuff in the background for malicious sites (especially malwaredomains).

    Doing this also helps stop malware CnC if you machine is infected. If a machine attempts to resolve its command and control by DNS it won't be able to connect. This isn't just for web ports, it is any port. So a machine may use a https tunnel on an off port (or 443) and it  will not connect buying some time to properly clean the machine (and also so it doesn't receive more stuff to do from the command and control server).

    DNS blackholes are very efficient, very fast and has proven itself as an extremely successful contribution to defence in depth and provides greater containment than say a proxy blocking a domain name.



  • @Kamel:

    A better/preferred solution (IMHO) would be to redirect to an internal page hosted on pfsense explaining why it was rejected just like squidguard. The issue with redirecting to 127.0.0.1 or not responding is they trick your PC into thinking it's going to get something if it goes there, so it will take a long time and then ultimately 'not respond'. This can also sometimes look like something is broken, so if you have a larger network you may get lots of "why isn't this website working" – as opposed to the user seeing and immediately understanding the reason it was blocked was due to alleged spyware and/or malware and it will remove all question. This will also aid in the troubleshooting process, as you would know immediately the reason this or that page is not functioning.

    Just my 2 cents, I highly support the idea though. I wonder if there are "lists" one could subscribe to like with pfblocker. BTW, sites simply being blocked with no explanation why (and system resource hogging) is why I don't use pfblocker.

    Another thing - if a machine is infected or could be infected if it was to visit site xyz.com say by an exploit kit exploiting a Java exploit and then dropping a unknown EXE (you will see how often things like these are recognised on virustotal.com :p) do you really care if a user sees a reason? Pfblocker perhaps I can see your point if you block a site which is in a country you have blocked (though users usually let you know pretty quick) but if you block a site on malwaredomains.com - which based on its latests updates has blocked Zeus, Blackhole Exploit Kit Domains, Russian Business Network Malvertisements, Botnets, Malicious Iframes, Mavertisements, malicious javascript and more. These are all bad - would you rather they were blocked outright and users don't get a message (they shouldn't need to connect to them unless they want some trojans on their machines so they are never going to bother you saying they couldn't connect to some work resource) or connect and receive the trojan? Blocking them by DNS blackhole reduces your workload drastically by helping to prevent infections and sending people to reimage machines due to some unrecognised trojan trying to steal data.


Log in to reply