[CentOS] Can one construct an IPTables rule to block on NS records?

Tue Oct 6 22:27:49 UTC 2015
Kahlil Hodgson <kahlil.hodgson at dealmax.com.au>

Taking a stab at you meaning "block all IPs that reverse resolve to a name
managed by secureserver.net" because their servers keep scanning you.

You could craft a fail2ban recipe to reverse resolve the IP address (after
a some threshold of rejected packets) then block that IP if it '
secureserver.net' is the authority for the PTR record.


Kahlil (Kal) Hodgson                       GPG: C9A02289
Head of Technology                         (m) +61 (0) 4 2573 0382
DealMax Pty Ltd                            GitHub: @tartansandal

Suite 1416
401 Docklands Drive
Docklands VIC 3008 Australia

"All parts should go together without forcing.  You must remember that
the parts you are reassembling were disassembled by you.  Therefore,
if you can't get them together again, there must be a reason.  By all
means, do not use a hammer."  -- IBM maintenance manual, 1925

On 7 October 2015 at 04:36, John R Pierce <pierce at hogranch.com> wrote:

> On 10/6/2015 6:34 AM, Leon Fauster wrote:
>> --On Monday, October 05, 2015 10:46 AM -0400 "James B. Byrne"<
>> byrnejb at harte-lyne.ca>  wrote:
>> >So, is there any convenient way to construct an IPTables rule to block
>>> >all IPs associated with a given Domain Name server?
>> IPs have the reversed lookup "assosiated" with a NS.
>> What do you mean with "associated"?
>>   Do mean all IPs that this DNS server resolves to
>> (A-Records in zone) (how do know for what zone
>> the NS gives authoritative answers)?
>> Or just the domain name server IPs of a given
>> domain name (NS records)?
>> What are you trying to solve?
> I wondered much the same.    most NS servers won't allow you to do a zone
> transfer to find all the A/AAAA records in a given domain. doing a reverse
> DNS lookup on every incoming/outgoing socket connection would be beyond
> painful, it would bring your network to its knees as the reverse DNS zones
> are often broken.
> --
> john r pierce, recycling bits in santa cruz
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> https://lists.centos.org/mailman/listinfo/centos