Utilizing ioc2rpz.net as open source RPZ


ioc2rpz community is a portal which provides open source DNS Firewall / RPZ feeds. The DNS Firewall feeds are based on publicly available threat intelligence(TI). The TI feeds are maintained by 3rd party communities or companies and only a limited number of indicators were whitelisted. Note that ioc2rpz  do not validate the TI feeds on false positives.

https://ioc2rpz.net/images/ioc2rpz_howto.gif
How to utilize the RPZ in EfficientIP:

1. Sign up on ioc2rpz site: https://ioc2rpz.net/

2. Once you verified your email you can login to your account.

3. Click RPZ feeds.

4. From the RPZ list select the RPZ you want to export.

5. Click export, ISC BIND.

6. Open the downloaded file, example:

options {
#This is just options for RPZs. Add other options as required
recursion yes;
response-policy {
####FQDN whitelists
####FQDN only zones
####IP whitelists
####Mixed zones
zone "adultfree.ioc2rpz" policy nxdomain;
####IP only zones
} qname-wait-recurse no break-dnssec yes;
};

key "ioc2rpz.net-b402c2e63f0443e31e3e"{
algorithm hmac-sha256; secret "252MZn84c1ajO7ZxDzEA6A==";
};


zone "adultfree.ioc2rpz" {
type slave;
file "/var/cache/bind/adultfree.ioc2rpz";
masters {94.130.30.123 key "ioc2rpz.net-b402c2e63f0443e31e3e";};
};

7. login to EfficientIP, DNS guardian smart architecture, properties, keys:

create new key:

key name: ioc2rpz.net-b402c2e63f0443e31e3e

key algorithm: hmac-sha256

TSIG key value: 252MZn84c1ajO7ZxDzEA6A==


8. create new slave RPZ, DNS guardian smart architecture, All RPZ zones.

DNS zone type: slave

Name: adultfree.ioc2rpz

Overriding rule: given

select the order

Master IP address: 94.130.30.123

TSIG key: ioc2rpz.net-b402c2e63f0443e31e3e

9. Now the RPZ is created check the log for the zone transfer and you can confirm that it is working by nslookup some of the domain you can find her:

https://raw.githubusercontent.com/blocklistproject/Lists/master/porn.txt


Did you find this article useful?



  • Measure QPS on BIND9

    BIND9 DNS engine was installed on Ubuntu server, the goal is to measure the QPS by enabling the statistics.Installing the BIND9 command: sudo apt inst...

  • Enabling DNSSEC on an external zone

    Domain Name System Security Extensions (DNSSEC) is used to strengthen DNS protocol security.It controls the integrity of all DNS answers and ensures t...

  • Enable Guardian for nonsupported interfaces

    Broadcom interface is not supported by default, only intel interfaces are supported for the Guardian service. this workaround only for POC: 1. login...

  • Cascaded DNS

    EDNS: Port 53 is reserved for DNS usage, DNS uses both UDP and TCP for message transport.Conventional message exchanges are short, and thus well suit...

  • NXDomain Redirection

    What is NXDOMAIN Redirection? NXDOMAIN redirection provides the ability for a recursive server to replace an NXDOMAIN response to a query with a conf...