The process of installing Microsofts pseudo VPN called Direct Access requires me to remove the ISATAP name from the default global block list by running this command:

dnscmd /config /globalqueryblocklist wpad

What are the implications of running this command and what are the benefits of leaving ISATAP blocked?


Microsoft Dynamic DNS allows hosts to request a specific host name they would like to use. (That's what the dynamic means!)

As you'd expect, you can't use this feature to steal an existing host's name, but there's a related attack where you steal the name of a host that doesn't exist, but that clients look for as part of an autodiscovery protocol.

For example, when Internet Explorer starts up, it tries to discover if there is a proxy server it should be using. One of the ways it does this is to try to connect to a server called wpad and download a Web Proxy Automatic Discovery configuration file.

Similarly, if you have an IPv4 network, and a client application that wants to send IPv6 traffic to somewhere, the client needs to find an Intra-site Automatic Tunnel Addressing Protocol (ISATAP) router - the client then wraps the IPV6 traffic in an IPV4 packet and sends it to the ISATAP router, which unwraps the traffic and sends it on. You guessed it: one of the ways the client finds a suitable router is to try connecting to a server called isatap and downloading a list.

So if you don't have hosts called wpad and isatap, you need to make sure that a malicious client can't register these names, as otherwise they can deliver fake configuration files to clients and steal traffic.

You'd think you'd just tell the DNS server not to hand out those names, but that would be too easy. Instead, you use the global block list, which is a list of names that the DNS server will never resolve, whether it has records for them or not. By default this list has two entries, wpad and isatap.

This means, then, that if things change and you set up a real wpad/istap host, you need to remove their names from the block list before it will work.

In your specific situation, Direct Access is IPV6 based, and the hosts your clients connect to must all use IPV6. So, if they are on an IPV4-only network, you have to deploy ISATAP for it to work, and hence you have to remove ISATAP from the global blocked list.

Doing this shouldn't introduce a security problem, because once Direct Access is in place you'll have a real host called isatap and malicious clients will not be able to register that name.

One last note for those wondering why you say dnscmd /config /globalqueryblocklist wpad when it's isatap you're enabling, not wpad. This command sets the block list to the specified value. i.e. by default the block list reads "wpad isatap" and the command changes it to just be "wpad".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.