Thread Info
Options
Suggested

What's the basic for compare source network names in firewall rules?

HGA

I want, that specific FQDN hosts, can't pass the firewall.
For that, I created a firewall rule with the action refuse (verwerfen).
Under source networks I put several FQDNs, which I don't want to pass the firewall. These FQDNs are reverse DNS names, which I got via nslookup!

I'm not an network specialist and so I have maybe a stupid question. 
The FQDNs names I have specified in this firewall rule, will be that compared also with the reverse DNS name or is it any other FQDN name, which can be different from the reverse DNS name?

Thanks for your support,
HGA



Edited TAGs
[edited by: Erick Jan at 12:27 AM (GMT -7) on 4 Aug 2025]
  • 0

    Hello!

    HGA said:
    The FQDNs names I have specified in this firewall rule, will be that compared also with the reverse DNS name or is it any other FQDN name, which can be different from the reverse DNS name?

    As far as I know, the Firewall doesn't use reverse DNS for this.

    By default It will resolve the IPv4/6 address of the defined FQDN, then use that IP address to block through the Firewall.

    If It's an wildcard FQDN, It will grab the A/AAAA record through DNS, and It works either way - if the client uses the Firewall as the DNS Server, or It will grab through the resolved DNS that the client resolved as long It's being resolved as plain-text. (Not using DoT or DoH.)

    If a post solves your question use the 'Verify Answer' button.

    Ryzen 7900 + Mellanox ConnectX-3 (KVM) v21.5 GA @ Home

    • 0 in reply to Prism

      So, the user can specify another FQDN, which could be different from the reverse DNS. That would mean, he can hide his real FQDN name (source). 
      For email servers, the reverse DNS is used, to verify the real source. In my opinion, that would be a security issue, if it is not possible to check against the reverse DNS.

      • 0 in reply to HGA
        HGA said:
        So, the user can specify another FQDN, which could be different from the reverse DNS. That would mean, he can hide his real FQDN name (source). 

        Kinda yes, if the user uses DNS over TLS or DNS over HTTPS, or get a different IPv4/6 that was been resolved by the Firewall, It will indeed bypass your reject rule. (Unless you're dropping all traffic and using FQDN's to allow only certain traffic.)

        Also, the Firewall doesn't use reverse DNS when blocking traffic with custom FQDN's, It will only resolve the IPv4/6 of the defined FQDN and block that IPv4/6 adddress.

        If a post solves your question use the 'Verify Answer' button.

        Ryzen 7900 + Mellanox ConnectX-3 (KVM) v21.5 GA @ Home