For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Vadym_Chepkov's avatar
Vadym_Chepkov
Icon for Nimbostratus rankNimbostratus
Jul 13, 2016

How to filter private IP space from DNS_RESPONSE

We would like to return 'not found' answer if an "outsider" requested A record with IP from private rfc1918 networks. How one would accomplish that with iRule? I saw some filtering examples available...
BIG-IP DNS
iRules
security
cjunior's avatar
cjunior
Icon for Nacreous rankNacreous
Jul 13, 2016

Hi, you can try to clear and respond a NXDOMAIN code, e.g.:

 

when DNS_RESPONSE {
    if { not [class match [IP::client_addr] eq private_net] } {
        DNS::answer clear
        DNS::header rcode NXDOMAIN
    }
}