Forum Discussion
Nimbostratusf5 GTM as DNS Express and Caching server
Hello.
Our costumerwould like to use f5 GTM as DNS Express server for their own zones. Because they are small ISP they would also like to implemtent f5 as cache server and doing recursive lookups. This meens that this would be an open resolver which is not good. Is there a way (maybe with irule) to limit which source IP addresses can query cache part of f5 GMT, so that we would be able to limit recursive querys only for their clients. I cannot find anything in config, f5 is licensed GTM only.
9 Replies
- Eric_St__John
Employee
You could configure a separate listener for each of the services, and then use an iRule to limit access to the caching resolver. Eric 
gapexx_138014But then I would probably have to use separated IP addresses for listeners.Hi Gapexx, I created a Listener and notice GTM creates a port 53 virtual server. Looking at that virtual server more closely, I see an option for "Source". The help page mentions:
Specifies an IP address or network from which the virtual server will accept traffic. For this setting to work, you must specify a value other than 0.0.0.0/0 or ::/0 (that is, any/0, any6/0). In order to maximize utility of this setting, specify the most specific address prefixes covering all customer addresses and no others.
Is this something you can test?
Kevin
- gapexx_138014I can try to test this in ma lab, but this will also limit traffic to dns express part whiich has to be available to everyone, since f5 is authoritative for those zones
TechgeeegGapexx you are right... if you modify the things on the VS level it will drop the traffic even from reaching the DNS Express ... you have to play with iRule to achieve what you are looking for...
- gapexx_138014
Thanks for your help everybody.
I think I found the solution in irules
when DNS_REQUEST { if { not [class match [IP::client_addr] eq "costumer-range" ] } { DNS::disable cache } }
- A__Stanley_1756Have you tested this iRule? I would like to do the same thing. Right now my customer is using DNS Express and on-box Bind because the native Bind allows for 'allow-recursion' and 'acl'
- gapexx_138014Hi, Yes I have tested this irule and it is also currently attached in production environment.
enordquist_1378If you have AFM you can simply apply an ACL on the VIP itself. iRules can accomplish this as well but such a large rule may affect performance.
