1

There are many methods to block unwanted outgoing requests. Examples include browser settings and extensions, and .hosts files. While DNS blocking won't affect direct accesses to a numeric IP address, it can be easily implemented to block entire domains and their subdomains, for an entire network as opposed to app-by-app or device-by-device.

Philosophically, DNS may not be the place do do such blocking, but it can be very effective, especially as part of a defense-in-depth strategy. What additional advantages and disadvantages are there to blocking with DNS?

Improve this question
7
  • An interesting related thread concerning DNS sinkholes, which is what I suppose you mean by "blocking with DNS".
    – WhiteWinterWolf
    Commented May 17, 2015 at 17:30
  • Basically, yes, although for simple privacy/security blocking purposes, it may simply be that the DNS server is configured to return NXDOMAIN or an error page (via beneficial DNS hijacking) for blacklisted (sub)domains.
    – pseudon
    Commented May 17, 2015 at 20:24
  • By way of example, let's say I determine that facebook.com is malicious and I want to block it. I simply configure my DNS server to not successfully resolve any requests to *.facebook.com and Facebook will never receive any packets from my network.
    – pseudon
    Commented May 17, 2015 at 20:37
  • @pseudon Facebook can still receive packets from your network in a number of cases; for instance, any device coming on to your network with a Facebook IP in a local DNS cache (which may not be that unusual) and any device connecting to Facebook directly by IP can still reach it.
    – cpast
    Commented May 17, 2015 at 22:52
  • @cpast Yes, I mentioned the direct IP bypass. True about foreign devices, though I'm mainly concerned about my own devices.
    – pseudon
    Commented May 18, 2015 at 1:04

2 Answers 2

Reset to default
1

Pros - Easy to implement network wide (DHCP server and a local DNS server are enough) - Easy to block (just add it to a list in the DNS server and route it to a bogus address or local address) - Easy to Bypass (if needed its easy to bypass)

Cons - Easy to bypass, just use a different DNS or add an entry to the hosts file is enough. - Is considered "Bad Network Practise" as you are redefining a Domain that is not yours.

In my opinion its better to either use a Proxy to redirect the users inside to a "Do not use" page. Possibly with the addition of IP blacklisting in your firewall.

Improve this answer
0

The advantage is that it is simple and reasonably effective against casual issues.

The disadvantage is that it is easily bypassed.

Check out OpenDNS as they offer this kind of service & I use this on the home network to help protect things.

Improve this answer
1
  • I've been doing this with OpenDNS for years, which is part of what prompted the question.
    – pseudon
    Commented May 18, 2015 at 1:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .