Block a name before the connection is made

short · 40 min · Objective 4.5

Task

Implement DNS filtering on your own resolver, prove it blocks before any connection is attempted, then defeat it the way a client does — and implement the control that closes that route.

Steps

  1. Run a local resolver on the Linux VM with logging enabled, and define a handful of names that resolve to your second lab VM -- among them allowed.lab and blocked.lab, the two the Verify queries.
  2. Add a block: configure blocked.lab to return NXDOMAIN. (A sinkhole address is the other common choice, and a real one; but it answers with an address, and this lab's point is the client that never learns one.)
  3. From the second VM, resolve and then connect to an allowed name and confirm both work.
  4. Now try the blocked name while capturing traffic. Confirm the resolution fails AND that no connection attempt to the target address appears in the capture at all.
  5. Defeat it: connect directly to the address, bypassing the name entirely, and note that DNS filtering had nothing to say about it.
  6. Close that route with a firewall rule restricting outbound to the resolver and to permitted destinations, and record in /tmp/dnsfilter.md why the two controls are complementary rather than redundant.

Files the Verify reads

The Verify block reads these by name, so save them exactly here:

  • /tmp/blocked-attempt.pcap -- a capture on the client while it tries the blocked name, e.g. tcpdump -i <interface> -w /tmp/blocked-attempt.pcap.

Verify

dig +short blocked.lab @10.99.0.10 | wc -l
tshark -r /tmp/blocked-attempt.pcap -Y "ip.addr==10.99.0.20 && tcp.flags.syn==1" 2>/dev/null | wc -l
dig +short allowed.lab @10.99.0.10 | wc -l
grep -ciE "before the connection|direct|ip address" /tmp/dnsfilter.md

The first must be 0 — the blocked name resolves to nothing. The second must also be 0, and it is the point of the lab: there is no SYN packet, because the client never learned an address to send one to. The third must be non-zero, proving the resolver still works for everything else rather than being broken.

Notes

The bypass you demonstrated is the real limitation, and the modern version is worse: a browser using DNS over HTTPS sends its lookups to a resolver you do not run, and your filtering stops applying entirely. That is why enterprise policy disables DoH or forces it to an internal endpoint.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.