Oct 7, 2026, 11:24 AM@thedarktangent DNS Response Policy Zones (RPZ)
- Oct 7, 2026, 11:24 AM
Replies
Oct 7, 2026, 11:39 AM@ckure @thedarktangent yes, this. You can set all sorts of magical things via policy, including rewriting responses, not just making them "fail". Supports wildcards too!
Jeff Mossthedarktangent@defcon.socialOct 7, 2026, 12:54 PM@ckure I'm not sure how an RPZ would help?
I would still need a way to allow only TCP connections from my server to the current cdn.network.com resolved address.
Something like
1 - "allow traffic from my server out to cnd.network.com"
2 - "Block everything else"And do this based on current name resolution for cdn.network.com. The only thing I can think of that could do this easily is if the thing doing name resolution can also add and remove rules dynamically.
- Oct 7, 2026, 1:15 PM
@thedarktangent maybe I misunderstood the problem. If you don’t want resolution you set RPZ for cdn.network.com to resolve to a blocked landing page IP, return NXDOMAIN, etc
If you’re looking for this to also involve packet filtering, yes my option doesn’t do that. But if you can enforce DNS through your RPZ resolver, no one except those in an “allow” policy will be able to resolve an IP for that name.
- Jeff Mossthedarktangent@defcon.socialOct 7, 2026, 1:20 PM
@ckure But nothing to stop someone from connecting directly to any IP address they want?
- Oct 7, 2026, 8:47 PM
@thedarktangent right, RPZ is like a DNS firewall. Intercepts requests and uses a policy to return customized results (blocked or rewritten responses). No layer 3 protection inherent to it. If you can connect to the IP and send eg host header, you’ll bypass the RPZ bc you’re not resolving its name