DNS Based IP Whitelisting

[DarkZek]

Hi, this project looks very cool!

I'm on the lookout for something very similar to this for my IoT network. The killer feature I am looking for is to be able to hook this up to my firewall to only allow requests to IP's that have been greenlit - with the idea of preventing my smart tv's from using a hardcoded list of ip's to send analytics to. I would even want to go as far as whitelisting domains that are allowed to be communicated with, and blocking everything else.

I wondered if this type of functionality was something you could see being integrated into this project?

[codefaux]

This is an extremely broad open-ended request. What's the interface protocol? Which side will listen for connections? How is it to be configured? Grouped, etc?

I think what you're looking for is; "How do I import these blocklists into my firewall?" -- I don't feel like there's any integration bonus between Faro (considering purely its context: DNS provider) and a firewall to add packet filter rules, but perhaps if upstream disagrees it may happen -- though consider how large of a request it is. And also provide some hints as to what to integrate with; opnSense, RouterOS, OpenWRT, Omada, Unifi, ...?

To integrate the blocklists with your firewall directly, you'll need to search for the name of each blocklist, and check their site to see which formats they provide their databases, and either find or write a short script to regularly download and re-import the blocklist into your firewall. I'm using RouterOS, my scripts are unlikely to help but I'll share them if you're also using RouterOS. If you share more details and where you're stuck, I'll try to help if I can, but that's less on-topic for this repo.

[derek-diaz]

Hmmm, that's an interesting request. 🤔 Yup, I agree with @codefaux that this can get pretty broad pretty quickly.

Faro, like most DNS filtering apps, ultimately decides whether a DNS request gets resolved or blocked. The idea of also exposing the IPs that were resolved is interesting though, since Faro is already seeing that information.

The tricky part is that DNS names and IP addresses aren't necessarily 1:1. One IP can host many completely unrelated services, especially with things like Cloudflare and other CDNs. So if Faro told a firewall "this IP is allowed" because an approved domain resolved to it, you could unintentionally allow access to other services sharing that same IP.

Then you also get into TTLs, changing CDN addresses, CNAMEs, IPv6, etc., which could turn into a pretty big can of worms pretty quickly.

I do think exposing resolved/allowed IPs through some generic interface could be interesting though, rather than having Faro directly integrate with every firewall vendor.

Faro already has some basic UniFi integration, so maybe that's a good place for me to experiment with this idea and see what's actually useful and technically practical. If something interesting comes out of that, it could help shape what a more generic integration interface would look like later. 👍

[DarkZek]

I agree its definitely a broad scope, i'm not really familiar with the networking space so wouldn't want to get too down into proposing a specific means of implementation.

Essentially the problem is that as much as blocklisting dns lookups can help with privacy, it's entirely voluntary for a device to use it. Whether its by hardcoding their own dns, or accessing IP addresses directly - IoT devices can't really be trusted which is where I worry projects like this and pihole could be improved.
I'm imagining a scenario where for example your LG smart tv (😛) is sending voice transcripts to some hardcoded ip, what options do you have to prevent that going through? We essentially need some more information about each ip so we can make some determination of whether to allow it or not. You can't have the firewall reverse dns lookup very easily (afaik?) so implementing this at the dns server layer makes a lot of sense. I'm not familiar with networking, but if Faro could act as a firewall you could force traffic through so it could enforce its own TTL's on the firewalls that sounds like the best idea to me - external connections add a lot of complexity.

The idea of whitelisting ip's is not perfect as you mention, but it's definitely an improvement and gives you more control over your network.

[codefaux]

Essentially the problem is that as much as blocklisting dns lookups can help with privacy, it's entirely voluntary for a device to use it. Whether its by hardcoding their own dns, or accessing IP addresses directly - IoT devices can't really be trusted which is where I worry projects like this and pihole could be improved.

I'd like to begin by saying please don't read hostility in my tone, it's an artifact of how I write and I'm not sure how to address it without altering my meaning.

To clarify my prior point, as I apparently did not say the actual part that mattered -- what you want is an IP Blocklist.

Faro is a DNS server, which loads upstream DNS Blocklists.
Your router is a firewall, which should be loading upstream IP Blocklists.

You are essentially asking Faro to build an IP list for the IPs covered by the DNS entries it is meant to block. Faro would need to resolve every DNS entry (these lists are VERY long) in every blocklist and scrape every IP (sometimes recursively if subdomains exist/are blocked) and maintain that database, then present it for your router/firewall to ingress. The alternative is any time an IP connection is attempted, check if it exists in a whitelist, then poll ...every DNS entry in the list until it's found? OK, let's whitelist IPs as soon as they're DNS-resolved, but what about good services/devices with hard-coded IP addresses?

(Aside: Hard-coded service IPs are incredibly uncommon, more likely they're using their own hard-coded DNS servers, which also could be covered by IP blocklists but it's not that helpful for Smart TVs etc -- absolutely everything at scale is on a CDN now, which provides hunreds if not tens of thousands of separate services, and CDNs are pooled and distributed across the globe, often in the same room as other CDNs and using the same IPs - HTTPS lookups use incoming server name to route so one IP can serve infinite different domains, and one domain can resolve to a hundred IP addresses in a hundred different countries, etc etc.)

The common implementation is to find a good IP blocklist and employ it, on your router or firewall appliance. Faro will not be involved, but Faro does not need to be involved. My router runs Mikrotik RouterOS, and polls several blocklists. Any IP request to/from those IPs, from/to anywhere on any network I manage, is dropped. This is what you want to do for your LG Smart TV (literally any smart TV, if you have a TV unplug it from the network they're so fkn ridiculously invasive you don't even understand -- ALL OF THEM, even your brand, yes the one you're about to object about, if it's smart-integrated it's one of them) and your Smart Thermostat and half of the apps on your phone and I could keep going.

Whitelisting IPs is a level of granularity which strikes me as deeply unapproachable. To that point; IP Whitelists don't exist. IP Blacklists do, but they're only one level of protection. If you think you need to whitelist a device's targets, what you really need is to unplug it and get a device you can actually trust. FYI most smart TVs stop working when you block their upstream; they deliberately use the same upstreams for both spying and delivering valid content (wether you're looking at DNS entries or IP pools) because it's been common knowledge that you can't trust smart TVs for long enough that people have started trying to block them enough that they noticed it impacting their lifetime post-sale product ownership revenue.

To get you started:

Abuse IPDB; www.abuseipdb.com -- Reported lists of IPs which are considered abusive. Lists which source this are a pretty great start, but continuing to not know what you're using, I can't make any suggestions because support is drastically varied. My scripts source and reparse one of the Hall of Shame lists and one of the timed main lists mirrored at https://github.com/borestad/blocklist-abuseipdb (don't use git clone, git history is unneccessary and will make the transaction take MUCH longer)

Crowdsec; https://www.crowdsec.net/ -- Crowd-sourced blocklists for firewalls as well as actual service ingress plugins. Free tiers, paid tiers, pretty good product, especially if you feed back to the community by deploying listeners which feed incoming behaviors back to their systems to distribute detection of malicious behaviors.

ASN-based lists exist because entire ASNs are dedicated to this bullshit now, and there are few other lists and list compilations, but one key to consider:

Your consumer firewall may very well not be able to handle a HUGE blocklist, and a full coverage blocklist will be huge. It takes RAM, it takes processing power. Filtering connections against a lot of lists can slow things down drastically. Most consumer routers simply cannot. As such, it's best to pick the minimum list you're comfortable with, and only one or two which do not overlap. If you employ a firewall appliance (or VM, or etc) this is definitely an easier reach. Whitelisting isn't viable because whitelisting an IP implies it only hosts good content, and that eliminates about 2/3 of providers because malicious actors are continually making new accounts and providers pool their IPs nowadays.

Faro acting as a firewall is certainly possible, but it would also need to act as a router and/or gateway to be of any use and then you're behind double NAT and everything gets ugly. Theoretically some devices could use the double-NAT and others could use the normal router, or on a separate VLAN and routed, etc etc.

IP Blocklists don't integrate with DNS lookup lists. There's an overlap, but each implements one part of a complete solution and they don't necessarily overlap in useful ways for integrating the two, unless Faro is to become wholesale a firewall/router applaince.

Share what you're using. I'll give a hand with integrating an IP Blocklist. This may serve better in Discussions, as it's not really related to Faro or an Issue with Faro at that point - start a discussion over there and ping me here.

[DarkZek]

You make some great points @codefaux thank you. I hadn't considered that about the whitelist solution.

Let's assume you have some separate vlan for your IoT devices, which must pass through a firewall controlled by Faro (whether it's your routers or something served by Faro). I think the missing link here might be that you disallow requests by default, and instead of whitelisting specific ip's allowed through, then each time Faro resolves a non-blocked dns entry it pushes it as an allow record to the firewall with the same ttl as the dns entry. This way you can just allow just a handful of dns entries for services you use, and all other traffic will not be allowed through.

I think with a solution like this we would avoid the problem you mention with having to bulk lookup dns entries, and with whitelisting ip's directly being cumbersome (totally agree). With it being whitelist I imagine the firewall rules will actually be smaller than large blocklists. It still has the problem of IP's hosting content & analytics, and your IoT devices refusing to work without analytics, but its still worth giving control over I think.

If you think you need to whitelist a device's targets, what you really need is to unplug it and get a device you can actually trust.

It does feel a bit backwards yeah 😅 I don't trust any of them, would love if it was easier to install some custom OS over smart tv's but alas DRM makes things difficult.