Reverse DNS Lookup

[someone6162]

Is there a way to block "reverse" DNS lookups while still allowing "foward" DNS lookups?

"Forward" DNS Lookup: returns the IP given a domain name (allow this)

"Reverse" DNS Lookup: returns the domain name given an IP (don't allow this!)

It's simply because I provide internet service to some tenants, some of which like to snoop around and ping things for the hell of it (which my ISP doesn't like). I've blocked pings on the network, and would like to know if it's possible to block "reverse" DNS lookups also.

 

[BuckWeet]

you could do this.. but you need a local dns server..

have everyone point to the local dns box, and then make the local dns box the SOA for the 0.0.0.0/0 subnet..

since nothing is in your local table, they can't reverse anything..


i'd do 2 servers for redundancy, and then just blocking dns out to the inet except for your 2 dns boxes..


BuckWeet

 

[3wsparky]

do you have a dns server on site ? if so cnat you apply an acl to only allow your dns server to make requests to the isp disallow any other device through and the clients would have to make there requests to the local dns server.

 

[someone6162]

Well, I don't "officially" have a DNS server onsite. But, what I do is get my router to relay the DNS requests. I did this by using the "IP dns server spoofing" command.

Can I still prevent reverse DNS lookups?

 

[RandeKnight]

I suspect that this is more work than is needed for something that they can work around with a 5 second google - eg, google for 'Reverse DNS lookup' and the first response is for a service which will do it for you. I suspect you don't want to block port 80 to prevent them using such services!

If they really are problematic, then change the terms of service and only give them web access through a proxy, with all other ports blocked.

Although, personally I see nothing wrong with ping, whois, nmap etc unless it's hampering other peoples access (ie, DOS). It's like walking down every street in a city looking at buildings and noting down which ones have doors open - suspicious, but not illegal.

Rand