Dynamic DNS URL Redirect Control

MGoodnow — Fri, 01 Aug 2014 19:49:53 GMT

Hello,

Most of the "Dynamic DNS" sites are categorized as Computer and Internet Info (PANDB). On occasion a device will get infected because of a Dynamic DNS redirect to a malicious site. The initial URL connection is through one of the DDNS sites. Because we allow "Computer and Internet Info", the connection is allowed to the final (malicious) destination. Besides hunting down every DDNS service and creating a custom URL block list - are there any solutions to better control these redirects? Thanks!

Cheers,

Mike

Re: Dynamic DNS URL Redirect Control

mivaldi — Tue, 05 Aug 2014 23:59:41 GMT

Assuming the URL is known to be malicious, you could implement DNS Sinkholing:

How to Configure DNS Sinkholing on PAN-OS 6.0

An alternative is to set an action of 'block' on your DNS Signature under your Anti-spyware profile.

I (personally) also like to configure my DNS server to point to OpenDNS servers and add an extra layer of protection (you can get an account with them, they will tie your public IP to the source of the DNS queries and filter those against their database). That means that you will be covered with both PAN-DB and OpenDNS databases for DNS queries.

Hope that helps,

Mariano.

topic Re: Dynamic DNS URL Redirect Control in General Topics

Dynamic DNS URL Redirect Control

Re: Dynamic DNS URL Redirect Control