Core 201 Test: DNS Firewall - Adding an iptables rule for primary.dbl.ipfire.org

[pscar13]

I just started testing CU201.
No problems during the upgrade via Pakfire.

Note: I’m using the “Outgoing blocked” option in the firewall’s default behavior, and I have a rule to only allow the DNS servers I’ve declared in the dns.cgi page.
Therefore, I had to add access to 81.3.27.55 (primary.dbl.ipfire.org) to my DNS access rules to get the DNS Firewall working.

[ms (Michael Tremer)]

Hello,

This thought has crossed my mind, but this IP address won’t be static for forever.

Currently we only have one node serving the zones but in the future that will increase. What IP addresses those will have I don’t know.

I do have however an idea for how we can solve this.

Do you even create rules for each of your DNS resolvers?

[pscar13]

@ms

Do you even create rules for each of your DNS resolvers?

I’m using the old rule to force the use of IPFire’s DNS.

Force clients to use IPFire DNS Server

To do this, I created a DNS service group

A rule to redirect DNS requests to IPFire

A group of allowed DNS resolver addresses

And a rule to allow access to these servers for DNS.

Finaly : I choose the DNS servers I want to activate on the dns.cgi page.

[tasos]

Sounds great! Thank you Phil! Will give it a try myself.

@pscar13

A rule to redirect DNS requests to IPFire