Web Filtering
We are looking at doing a DNS web filtering service. We have public WiFi so we feel this is the easiest way to avoid an ssl mismatch.
If we did do DNS filtering, would it be logical for us to block all connections to port 53 UDP unless it's to the web filtering DNS servers? This way someone can bypass it by changing their DNS servers?
If we did do DNS filtering, would it be logical for us to block all connections to port 53 UDP unless it's to the web filtering DNS servers? This way someone can bypass it by changing their DNS servers?
ASKER
So your saying to leave port 53 open to anything, point the dhcp DNS servers to the filtering provider and put together a black list of known DNS servers, then add the blacklist to block on the firewall?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Please see attached. Is this what you mean? I have put the two dns servers I need everyone to be using within that alias (dnsfilter internal). Underneath is a reject rule for anything else for port 53 TCP/UDP.
DNS.png
DNS.png
Yes, it is.
If your web filtering service is based on DNS it would seem prudent to block access to other DNS servers otherwise getting around the filter is far too easy.
With that options to get around it are reduced somewhat. Those still include services which might use alternate ports, or tunneling, or proxy services and so on.