Home / server / Questions / 702793
In Process
Cha0s
Asked: 2015-07-02 02:23:31 +0800 CST

Block Dynamic DNS update requests

  • 772

I need to block all dynamic dns services update requests from my network so that no dyndns client be able to update its IP.

Do the major dyndns providers use a standard protocol or each one uses its own proprietary one?

Is it possible to match the update requests globally or do I need to find out each provider's IPs to block them manually?

firewall

1 Answers

  1. You can approach this in three ways: a) with a transparent proxy that blocks the hosts, b) with a firewall that blocks the connections to the update hosts or c) in your internal DNS and resolve the known update hosts to localhost or some other host.

    Using a) you can just blacklist (in squid with squidguard or or even iptables) the update hosts

    Using b) you'll have to track the changes in the update hosts' IPs and block outgoing requests to those hosts - with a script to regularly poll the update host DNS entry and retrieve IPs to block.

    using c) - my personal favorite - get a list of update hosts and redirect to an internal host managed by you. you can even feed fake information to your users as a bonus.

    Here is a handy list of known DDNS providers and their update hosts.

    Because anyone can run their own DDNS service, and typically these services run on top of HTTP(s) you have to either block each provider's update host or eventually match the urls in your proxy and redirect them to a host managed by you.

    • 1