0

I need to block all dynamic dns services update requests from my network so that no dyndns client be able to update its IP.

Do the major dyndns providers use a standard protocol or each one uses its own proprietary one?

Is it possible to match the update requests globally or do I need to find out each provider's IPs to block them manually?

Cha0s
  • 2,462
  • 2
  • 16
  • 26
  • Run a packet sniffer and look for the packets and see what port they listen to. Try run nmap on a lab machine running dyndns to see what port that are open. – Victor Nordmark Jul 01 '15 at 10:47
  • I was hoping to avoid all that hustle that's why I created this question so that if someone else already had done this, spare me the trouble. But if no one suggests anything I will have to do this myself :) – Cha0s Jul 01 '15 at 15:00

1 Answers1

1

You can approach this in three ways: a) with a transparent proxy that blocks the hosts, b) with a firewall that blocks the connections to the update hosts or c) in your internal DNS and resolve the known update hosts to localhost or some other host.

Using a) you can just blacklist (in squid with squidguard or or even iptables) the update hosts

Using b) you'll have to track the changes in the update hosts' IPs and block outgoing requests to those hosts - with a script to regularly poll the update host DNS entry and retrieve IPs to block.

using c) - my personal favorite - get a list of update hosts and redirect to an internal host managed by you. you can even feed fake information to your users as a bonus.

Here is a handy list of known DDNS providers and their update hosts.

Because anyone can run their own DDNS service, and typically these services run on top of HTTP(s) you have to either block each provider's update host or eventually match the urls in your proxy and redirect them to a host managed by you.

ppalmeiro
  • 11
  • 3
  • The link (ddns list) you posted does not work. Can you update your post please? To be honest I was hoping for something more robust. Like L7 matching of the update requests packets regardless of any block list (which will definitely need to be kept updated). I guess I will have to do the dirty work (sniffing) myself to figure it out that way as Victor suggested. – Cha0s Jul 01 '15 at 14:58