For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

dearsanky's avatar
dearsanky
Icon for Nimbostratus rankNimbostratus
Feb 28, 2016

DNS Recursion Desire restriction and Blacklist

Hi, I am writing an iRule to insert answer for blacklist domain, restrict query based on source (defined in Datagroup), Answer all query from everyone coming for Authoritative Answer. Need help to g...
BIG-IP DNS
iRules
security
Kai_Wilke's avatar
Kai_Wilke
Icon for MVP rankMVP
Mar 02, 2016
Just checked the outcome of the "DNS::last_act reject" in my demo environment and can confirm the functionality of the optimized iRule syntax. On the first sight "DNS::last_act reject" has basically the same outcome as a "DNS::drop". And both commands will work without any issues using just the DNS_REQUEST event to make it more performant. In the meantime I've also found the origin of your iRule (https://devcentral.f5.com/s/articles/v111-dns-blackhole-with-irules) Well, I still duno why the provided sample code uses the DNS_RESPONSE event, if the DNS request already holds every information to simply intercept and respond the DNS request on behalf of the DNS servers. Cheers, Kai