1

There are many methods to block unwanted outgoing requests. Examples include browser settings and extensions, and .hosts files. While DNS blocking won't affect direct accesses to a numeric IP address, it can be easily implemented to block entire domains and their subdomains, for an entire network as opposed to app-by-app or device-by-device.

Philosophically, DNS may not be the place do do such blocking, but it can be very effective, especially as part of a defense-in-depth strategy. What additional advantages and disadvantages are there to blocking with DNS?

  • An interesting related thread concerning DNS sinkholes, which is what I suppose you mean by "blocking with DNS". – WhiteWinterWolf May 17 '15 at 17:30
  • Basically, yes, although for simple privacy/security blocking purposes, it may simply be that the DNS server is configured to return NXDOMAIN or an error page (via beneficial DNS hijacking) for blacklisted (sub)domains. – pseudon May 17 '15 at 20:24
  • By way of example, let's say I determine that facebook.com is malicious and I want to block it. I simply configure my DNS server to not successfully resolve any requests to *.facebook.com and Facebook will never receive any packets from my network. – pseudon May 17 '15 at 20:37
  • @pseudon Facebook can still receive packets from your network in a number of cases; for instance, any device coming on to your network with a Facebook IP in a local DNS cache (which may not be that unusual) and any device connecting to Facebook directly by IP can still reach it. – cpast May 17 '15 at 22:52
  • @cpast Yes, I mentioned the direct IP bypass. True about foreign devices, though I'm mainly concerned about my own devices. – pseudon May 18 '15 at 1:04
1

Pros - Easy to implement network wide (DHCP server and a local DNS server are enough) - Easy to block (just add it to a list in the DNS server and route it to a bogus address or local address) - Easy to Bypass (if needed its easy to bypass)

Cons - Easy to bypass, just use a different DNS or add an entry to the hosts file is enough. - Is considered "Bad Network Practise" as you are redefining a Domain that is not yours.

In my opinion its better to either use a Proxy to redirect the users inside to a "Do not use" page. Possibly with the addition of IP blacklisting in your firewall.

0

The advantage is that it is simple and reasonably effective against casual issues.

The disadvantage is that it is easily bypassed.

Check out OpenDNS as they offer this kind of service & I use this on the home network to help protect things.

  • I've been doing this with OpenDNS for years, which is part of what prompted the question. – pseudon May 18 '15 at 1:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.