Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Allow ISATAP and WPAD in OpenDNS Whitelist?

Posted on 2012-04-11
5
Medium Priority
?
1,144 Views
Last Modified: 2012-04-12
I have recently implemented OpenDNS web content filtering at all of my company's retail locations.  I've chosen to use their Whitelist available with the Enterprise package to limit access.  Choosing this method required us to compose a list not only of sites they will need to browse but sites necessary for all related technology to function and update.

In monitoring the blocked domains I have found a number of isatap.<domain> and wpad.<domain> entries.  I have researched these but I have not yet found anything which can assure me that it will be safe to allow them.  OpenDNS, naturally, uses their DNS servers to enforce the filtering so I need to be absolutely sure these will not allow users to bypass this.

This may be a silly question for you networking gurus, but I am not yet there and would really appreciate some help understanding this.  Thanks!
0
Comment
Question by:YD_IT_Guy
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 17

Accepted Solution

by:
BudDurland earned 2000 total points
ID: 37836732
Both ISATAP and WPAD are used by computer to search for additional configuration options.  When a browser starts, it will look for wpad.<domain>, and if found, will fetch from that host any corporate required proxy settings.  ISATAP is used, I beleive, for IPV6 settings.  I would not whitelist these entries, to avoid having them hijacked.  If you are very concerned, add an entry for each to the computers HOSTS file, pointing to 127.0.0.1
0
 

Author Comment

by:YD_IT_Guy
ID: 37838263
Thank you.  Your answer is what I needed and your solution is professional.  However, I feel the danger of hijacking is nil and blocking via hosts file is laborious with this number of remote machines.  If hijacking is not a concern of mine, would you see a problem adding them to the whitelist just to get them off my blocked domains report? Otherwise, I would probably continue with them being blocked in this fashion.

Thank you for your help!
0
 

Author Comment

by:YD_IT_Guy
ID: 37838961
More specifically, could allowing WPAD.<domain> potentially allow access to restricted sites via proxy?  If this is not a danger, I would prefer to allow wpad and isatap.
0
 
LVL 17

Expert Comment

by:BudDurland
ID: 37840708
The danger would be if someone your domain's DNS server was victim to hijacking or cache poisoning.  In that event,va bad guy could create an entry for wpad.domain>,  which would then point your users browsers to some bogus proxy server that could , for example, redirect all sites to something completely different.

So, blocking resolution of wpad and isatap is probably advisable.
0
 

Author Comment

by:YD_IT_Guy
ID: 37840742
Understood, I appreciate your explaining this further.  We will continue to block these via OpenDNS until we create a hosts file to push out to locations.

Thanks again!
0

Featured Post

Simplify Your Workload with One Tool

How do you combat today’s intelligent hacker while managing multiple domains and platforms? By simplifying your workload with one tool. With Lunarpages hosting through Plesk Onyx, you can:

Automate SSL generation and installation with two clicks
Experience total server control

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
Most of the applications these days are on Cloud. Cloud is ubiquitous with many service providers in the market. Since it has many benefits such as cost reduction, software updates, remote access, disaster recovery and much more.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question