1

I would like to find out if it's possible to restrict insecure updates to a single IP. I have a firewall with a DHCP, which is capable of sending DNS updates, even signing them with TSIG, but only HMAC/MD5. So for that scenario I'm only left with insecure updates for a zone, but I don't want to open it up for anyone, just for my Firewall.

While zone transfers can be limitide to IPs and there is Add-DnsServerQueryResolutionPolicy, I couldn't find a way to establish a policy limiting the access for updates to a single IP.

Improve this question
2
  • It is unclear what you are asking about. If you wish to limit access to your DNS server then set up a firewall rule. What exactly is a DNS update? Describe the services and state os-version or/and service-binary(program)-versions. Your question assumes your readers understand the context as if it was obvious, which it is not. I am probably not going to be able to answer your question anyway (since i don't know windows server), but you need to state questions precisely. "Insecure update to a single IP" makes absolutely no sense unless you define the context. DHCP is not supposed to send DNS...
    – Ярослав Рахматуллин
    Mar 5, 2021 at 23:40
  • I'm afraid this question is in contrary way to specific and simply not possible to achive with windows server. DNS update is described in RFC3007, and it can be used to update a DNS record. E.g. a DHCP server hands out a lease to a client (PC1) and registers that lease with the local subdomain pc1.foo.example.com. This can and should be secured, so only the DHCP can do that, not just anyone. Unfortunatly my DHCP server only offers TSIG-HMAC auth, while the windows DNS only works with Kerberos auth. Restricting the update to an src IP would be a solution.
    – engelant
    Mar 6, 2021 at 8:05

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .