DNS Queries Using API - BIND9

[Blason R]

Hi Folks,

I am seeking solution for our below problem and wanted to know if any open
source option can help us here?
We have our internal DNS RPZ firewall built on BIND9. Due to the current
situation since all users are working from home we are not able to route
their queries to internal DNS servers. Well, when they are on VPN
definitely queries are then passed through internal DNS server but they
left open when not connected to VPN.

Is there any solution using -

- API by which we can route the queries for user who are on Internet
- Or any client utility which can be installed on user's desktop/laptop
where we can embed our BIND RPZ server and then route the queries to
internal one using NAT?
- Or any other alternative community can suggest?


This is just like Cisco Umbrella or any other Paid DNS firewall solutions
but seeking if we can have any open source option?

Thanks & Regards
Blason R

[Vadim Pavlov]

Hi Blason,

There are open source clients for iOS (DNSCloak) and Android (Intra) which use DoH (you will need to install a DoH proxy) but I’m not aware about free clients for Mac/Windows/Linux (may be because they have embedded clients which can be configured to use any 3rd party DNS :).
The main issue that bind does’t provide an authentication method. So in any case you somehow should manage the access to the DNS server vice versa it will became open resolver and will be used for DDoS attacks.

I would recommend you a few options here:
- Use a trial for any “paid” solutions. E.g. Infoblox offers 90 days free trial - i may be enough to pass the WFH stage;
- Require VPN back to your HQ and provision to automatically establish them;
- Install bind on these laptops and push RPZ feeds directly to them (zone transfer can be authenticated by using TSIG Keys). You may see issues if the feeds size >1m rules.
- Provide your employees VMs (if they have servers a home) or even Raspberry Pi to protect the whole home network (actually it is important). On my ioc2rpz community (https://ioc2rpz.net <https://ioc2rpz.net/>) you can take a look on RpiDNS installation script. It installs ICS Bind and provision my community RPZ feeds (you may replace it by your feeds), OpenResty for admin interface and a walled garden page + provision RSyslog. On Raspberry Pi Zero the installation takes about 10 minutes (demo video - https://www.youtube.com/watch?time_continue=2&v=942yKOGAwbU&feature=emb_logo <https://www.youtube.com/watch?time_continue=2&v=942yKOGAwbU&feature=emb_logo>).


BR,
Vadim

Post by Blason R
Hi Folks,
I am seeking solution for our below problem and wanted to know if any open source option can help us here?
We have our internal DNS RPZ firewall built on BIND9. Due to the current situation since all users are working from home we are not able to route their queries to internal DNS servers. Well, when they are on VPN definitely queries are then passed through internal DNS server but they left open when not connected to VPN.
Is there any solution using -
API by which we can route the queries for user who are on Internet
Or any client utility which can be installed on user's desktop/laptop where we can embed our BIND RPZ server and then route the queries to internal one using NAT?
Or any other alternative community can suggest?
This is just like Cisco Umbrella or any other Paid DNS firewall solutions but seeking if we can have any open source option?
Thanks & Regards
Blason R
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
bind-users mailing list
https://lists.isc.org/mailman/listinfo/bind-users

[Daniel Stirnimann]

The main issue that bind does’t provide an authentication method. So in
any case you somehow should manage the access to the DNS server vice
versa it will became open resolver and will be used for DDoS attacks.

If you were to use DoH, you could use Basic Authentication. The DoH URL
you could configure on your client systems could be something like this:

https://username:***@doh.example.com/dns-query


Daniel

[Vadim Pavlov]

Good idea. It may work. I’m using Intra for 1.5 years (with my DNS) and actually didn’t try it likely my DoH “old” proxy probably doesn’t support it.
With nginx it should be possible if these open source clients support it.
For Win/Mac/Linux there should be some open source DoH clients (backup will be using it just in browsers).

Vadim

Post by Daniel Stirnimann

The main issue that bind does’t provide an authentication method. So in
any case you somehow should manage the access to the DNS server vice
versa it will became open resolver and will be used for DDoS attacks.

If you were to use DoH, you could use Basic Authentication. The DoH URL
Daniel

[Blason R]

I can do that - But


1. How can I control unauthorized use?
2. Since one its populated over Internet it can be used by any one right?
3. Plus from user end they can change the DNS to avoid protection.

Post by Blason R
I am seeking solution for our below problem and wanted to know if any
open source option can help us here?
We have our internal DNS RPZ firewall built on BIND9. Due to the current
situation since all users are working from home we are not able to route
their queries to internal DNS servers. Well, when they are on VPN
definitely queries are then passed through internal DNS server but they
left open when not connected to VPN.
Is there any solution using -
* API by which we can route the queries for user who are on Internet
* Or any client utility which can be installed on user's
desktop/laptop where we can embed our BIND RPZ server and then route
the queries to internal one using NAT?
* Or any other alternative community can suggest?

when you are in the position to use something like this you can also
tell your users they have to configure their machines for using a public
dns you are hosting and you are done

[Blason R]

Hmm- Any docs on configuring DOH Proxy?

On Mon, May 11, 2020 at 11:56 AM Daniel Stirnimann <

Post by Daniel Stirnimann

Post by Vadim Pavlov
The main issue that bind does’t provide an authentication method. So in
any case you somehow should manage the access to the DNS server vice
versa it will became open resolver and will be used for DDoS attacks.

If you were to use DoH, you could use Basic Authentication. The DoH URL
Daniel

[Blason R]

Thats a nice starting point -

https://www.nginx.com/blog/using-nginx-as-dot-doh-gateway/

But still looking for any client utility so that users can not shutdown or
can not suspend the service

Post by Blason R
Hmm- Any docs on configuring DOH Proxy?
On Mon, May 11, 2020 at 11:56 AM Daniel Stirnimann <

Post by Daniel Stirnimann

Post by Vadim Pavlov
The main issue that bind does’t provide an authentication method. So in
any case you somehow should manage the access to the DNS server vice
versa it will became open resolver and will be used for DDoS attacks.

If you were to use DoH, you could use Basic Authentication. The DoH URL
Daniel

[Vadim Pavlov]

If your users has admins permissions you probably will not find any open source tool which support that. For restricted accounts on Win - create policies.

BR,
Vadim

Post by Blason R
Thats a nice starting point -
https://www.nginx.com/blog/using-nginx-as-dot-doh-gateway/ <https://www.nginx.com/blog/using-nginx-as-dot-doh-gateway/>
But still looking for any client utility so that users can not shutdown or can not suspend the service
Hmm- Any docs on configuring DOH Proxy?

Post by Vadim Pavlov
The main issue that bind does’t provide an authentication method. So in
any case you somehow should manage the access to the DNS server vice
versa it will became open resolver and will be used for DDoS attacks.

If you were to use DoH, you could use Basic Authentication. The DoH URL
Daniel

[Blason R]

Nah those are regular users - And thinking to work on DoT Proxy and force
that through GPO for browsers.

Post by Vadim Pavlov
If your users has admins permissions you probably will not find any open
source tool which support that. For restricted accounts on Win - create
policies.
BR,
Vadim
Thats a nice starting point -
https://www.nginx.com/blog/using-nginx-as-dot-doh-gateway/
But still looking for any client utility so that users can not shutdown or
can not suspend the service

Post by Blason R
Hmm- Any docs on configuring DOH Proxy?
On Mon, May 11, 2020 at 11:56 AM Daniel Stirnimann <

Post by Daniel Stirnimann

Post by Vadim Pavlov
The main issue that bind does’t provide an authentication method. So in
any case you somehow should manage the access to the DNS server vice
versa it will became open resolver and will be used for DDoS attacks.

If you were to use DoH, you could use Basic Authentication. The DoH URL
Daniel

[Reindl Harald]

Post by Blason R
I am seeking solution for our below problem and wanted to know if any
open source option can help us here?
We have our internal DNS RPZ firewall built on BIND9. Due to the current
situation since all users are working from home we are not able to route
their queries to internal DNS servers. Well, when they are on VPN
definitely queries are then passed through internal DNS server but they
left open when not connected to VPN.
Is there any solution using -
* API by which we can route the queries for user who are on Internet
* Or any client utility which can be installed on user's
desktop/laptop where we can embed our BIND RPZ server and then route
the queries to internal one using NAT?
* Or any other alternative community can suggest?

when you are in the position to use something like this you can also
tell your users they have to configure their machines for using a public
dns you are hosting and you are done

[Petr Menšík]

Hi,

AFAIK BIND is supported also on Windows. Would it be possible just to
install BIND service on local machine and configure it to download DLZ
zone from your servers. It could authenticate using ddns keys. And
forward would be also straightforward. As a bonus, they would get local
validating resolver.

I think that would be quite satisfying for their security, but would
prevent you from watching them too close. I think that would be an
advantage in sort, especially when they are in "private" mode.

Of course some scripts to configure the installation would be required,
because ordinary user does not want to configure BIND. Some smart
installer might be enough.

Regards,
Petr

Post by Blason R
Hi Folks,
I am seeking solution for our below problem and wanted to know if any open
source option can help us here?
We have our internal DNS RPZ firewall built on BIND9. Due to the current
situation since all users are working from home we are not able to route
their queries to internal DNS servers. Well, when they are on VPN
definitely queries are then passed through internal DNS server but they
left open when not connected to VPN.
Is there any solution using -
- API by which we can route the queries for user who are on Internet
- Or any client utility which can be installed on user's desktop/laptop
where we can embed our BIND RPZ server and then route the queries to
internal one using NAT?
- Or any other alternative community can suggest?
This is just like Cisco Umbrella or any other Paid DNS firewall solutions
but seeking if we can have any open source option?
Thanks & Regards
Blason R
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
bind-users mailing list
https://lists.isc.org/mailman/listinfo/bind-users

[Blason R]

Hmmm nice suggestion and appreciate that.

But it would too much for normal user looking for more simpler manner. Any
way if no option then will have to live with vpn option for now.

Post by Petr Menšík
Hi,
AFAIK BIND is supported also on Windows. Would it be possible just to
install BIND service on local machine and configure it to download DLZ
zone from your servers. It could authenticate using ddns keys. And
forward would be also straightforward. As a bonus, they would get local
validating resolver.
I think that would be quite satisfying for their security, but would
prevent you from watching them too close. I think that would be an
advantage in sort, especially when they are in "private" mode.
Of course some scripts to configure the installation would be required,
because ordinary user does not want to configure BIND. Some smart
installer might be enough.
Regards,
Petr

Post by Blason R
Hi Folks,
I am seeking solution for our below problem and wanted to know if any

open

Post by Blason R
source option can help us here?
We have our internal DNS RPZ firewall built on BIND9. Due to the current
situation since all users are working from home we are not able to route
their queries to internal DNS servers. Well, when they are on VPN
definitely queries are then passed through internal DNS server but they
left open when not connected to VPN.
Is there any solution using -
- API by which we can route the queries for user who are on Internet
- Or any client utility which can be installed on user's

desktop/laptop

Post by Blason R
where we can embed our BIND RPZ server and then route the queries to
internal one using NAT?
- Or any other alternative community can suggest?
This is just like Cisco Umbrella or any other Paid DNS firewall solutions
but seeking if we can have any open source option?
Thanks & Regards
Blason R
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to

unsubscribe from this list

Post by Blason R
bind-users mailing list
https://lists.isc.org/mailman/listinfo/bind-users

--
Petr Menšík
Software Engineer
Red Hat, http://www.redhat.com/
PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to
unsubscribe from this list
bind-users mailing list
https://lists.isc.org/mailman/listinfo/bind-users