Hi.
Am Mittwoch, den 08.08.2018, 22:27 +0100 schrieb Danny Horne via users:
Hi all,
I've been trying to add a subnet to my firewalld drop zone because
queries from this subnet have been filling up my named logs and I've
had enough!!
Based on research these are some assumptions I've made -
Adding a subnet to a zone makes it an active zone
Zones with subnets take precedence over those with interfaces
attached
connection refused resolving
'243.32.237.94.bb.barracudacentral.org/A/IN': 64.235.145.15#53 << In
this example 64.235.145.15 is the source IP (am I right?)
No, this is the queried DNS. It is the authoritative NS for the Domain
barracudacentral.org.
Seems to be some kind of reverse entry which does not resolve
correctly. The Source for the query is not mentioned. The authotitative
can not resolve this query (tested) and therefore the query is answered
with code NXDOMAIN.
This is what I've done to try and achieve what I want -
firewall-cmd --permanent --zone=drop --add-source=64.235.144.0/20
(I've
researched this, subnet is correct)
firewall-cmd --reload
I'm still getting queries to my DNS servers from this subnet though,
what have I missed?
You have to find out whi issues the query. I would disable recursion at
all except for the internal network.
Find out who queries this domains and answer witth NXDOMAIN, disabling
recursion would do thos. Blocking DNS queries if you are authotitative
for internet domains is generally a very bad idea.
Regards,
Dirk
--
Dirk Gottschalk
Paulusstrasse 6-8
52064 Aachen, Germany
GPG: DDCB AF8E 0132 AA54 20AB B864 4081 0B18 1ED8 E838
Keybase.io:
https://keybase.io/dgottschalk
GitHub:
https://github.com/Dirk1980ac