Login
You're viewing the y.diskcat.com public feed.
  • Jeff Mossthedarktangent@defcon.social
    Oct 7, 2026, 12:54 PM

    @ckure I'm not sure how an RPZ would help?

    I would still need a way to allow only TCP connections from my server to the current cdn.network.com resolved address.

    Something like
    1 - "allow traffic from my server out to cnd.network.com"
    2 - "Block everything else"

    And do this based on current name resolution for cdn.network.com. The only thing I can think of that could do this easily is if the thing doing name resolution can also add and remove rules dynamically.

    💬 1🔄 0⭐ 1

Replies

  • Seth Hanford 🐡ckure@infosec.exchange
    Oct 7, 2026, 1:15 PM

    @thedarktangent maybe I misunderstood the problem. If you don’t want resolution you set RPZ for cdn.network.com to resolve to a blocked landing page IP, return NXDOMAIN, etc

    If you’re looking for this to also involve packet filtering, yes my option doesn’t do that. But if you can enforce DNS through your RPZ resolver, no one except those in an “allow” policy will be able to resolve an IP for that name.

    💬 1🔄 0⭐ 1
  • Jeff Mossthedarktangent@defcon.social
    Oct 7, 2026, 1:20 PM

    @ckure But nothing to stop someone from connecting directly to any IP address they want?

    💬 1🔄 0⭐ 2
  • Seth Hanford 🐡ckure@infosec.exchange
    Oct 7, 2026, 8:47 PM

    @thedarktangent right, RPZ is like a DNS firewall. Intercepts requests and uses a policy to return customized results (blocked or rewritten responses). No layer 3 protection inherent to it. If you can connect to the IP and send eg host header, you’ll bypass the RPZ bc you’re not resolving its name

    💬 0🔄 0⭐ 1