How to setup a DNS blacklist / whitelist on windows server 2008 R2

Question

Basically as the title says I would like to be able to lockdown the internet through DNS settings on Windows Server 2008 R2 - preferably I would lock down everything and then just have a 'whitelist' of certain ip addresses / domain names - is this possible?

It can be done via the router, but I think due to the number of users we have on our network (50+) it struggled with the workload, so any help with getting the server to do the legwork rather than the router would be much appeciated, thanks.

Answer 1

By firewall:

1. Log into your server via Remote Desktop Connection.
2. Start -> administrative tools > windows firewall with advanced security.
3. On the left side of the firewall window click on the inbound rules option.
4. On the right side of the screen click on New Rule.
5. Click on the custom radio button and then click next.
6. Make sure the All programs radio is selected then click next.
7. On the protocol and ports options leave everything at its defaults and click next.
8. On the scope screen you will see two boxes the top one is for local IP addresses and the bottom is for remote IP addresses. In this scenario we are trying to block an outside (remote) IP from accessing anything on the server so we will need to add the IP address to this section only as it will not be a local IP address.
9. Click on the radio that says “these IP addresses ” in the remote section as shown below:
10. Click on the Add button.
11. In the next window we will be adding a single IP address to the rule, you can also add an entire range at this point if you wish.
12. Click ok, click next.
13. Make sure you select the Block the connection radio on the next screen and then click next.
14. Leave all of the options on the next screen checked this will be sure to block the IP no matter the connection they are trying to use. Click next.
15. Name the rule on the next screen something you can remember in case you wish to remove or edit it in the future. Click finish and that's it.

Source: http://www.studyblog.net/2011/10/block-ip-address-or-ip-range-in-windows-server-2008-by-windows-firewall/

By DNS (which looks more fiddly) (Sorry to send you away but there is so much content on each I can't copy the answer) http://blogs.technet.com/b/isablog/archive/2008/02/19/windows-server-2008-dns-block-feature.aspx

Answer 2

That answer is not an answer and doesn't even address the question. The answer provided above is how to write a rule to block all access to a server or workstation by blocking the ip in the firewall and doesn't address the dns name at all, and therefore doesn't address the actual question.

My research has led me to thing that if you are running 2016 DNS you can do this with dns query policy but not any previous version.

The main reason one might want this is the BS fake UDP packets hitting MS dns servers around the world, so response rate limiting would help also, but again only available on 2016 (even though Bind has had it for years and years)

There is also the Query Block List but this likely only works on recursive lookups and does nothing for the fake requests for NXDomains on authoritative dns servers as I wrote those blocks and the queries still come.

The best way I have found to combat this is #1 Make sure recursives are disabled, #2 return the NXDomain response making sure your dot zone (.) has no records including no name server records. This will return the smallest packet in response and the amplification part of the attack is mostly nullified.