Filter DNS Forwarded responses with Bind

Question

What options do I have for blocking DNS query responses containing a specific IP address or range?

I'm reading up on DNS Rebinding attacks, and wondering how I might block them.

When an attacker attempts a rebinding attack, they will attempt to trick the browser into believing that the malicious content was served from 127.0.0.1 or an address within my LAN. They do so by configuring their DNS server to serve the fraudulent address (when queried from within the malicious script). I would like to prevent this by blocking all responses to forwarded DNS queries that result in a local or LAN address.

I use a Bind9 zone for my local network and use forwarders to resolve external addresses.

The Bind box is a Debian server behind my NAT router. It runs UFW for firewall, and allows TCP/UDP over port 53.

Answer 1

It is possible to get Bind to filter the addresses returned using the deny-answer-addresses feature. To use this add the following to the options section of your /etc/bind/named.conf.options configuration file:

deny-answer-addresses { 192.0.2.0/24; } except-from { "example.net"; };

This will prevent any 192.0.2.x address from being returned in response to any DNS query except from the locally hosted example.net domain.

The Bind manual also recommends filtering aliases with:

deny-answer-aliases { "example.net"; };

A suggested set of filters I found at http://www.sput.nl/internet/dns-morons.html seems to cover the most common DNS rebinding attacks based on my own testing:

deny-answer-addresses {
    // Unconfigured
    0.0.0.0;
    // RFC 1918
    10.0.0.0/8;
    172.16.0.0/12;
    192.168.0.0/16;
    // RFC 3927
    169.254.0.0/16;
    // IPv6
    // :: to ::ffff:ffff:ffff.
    // Includes ::, ::1, IPv4-Compatible IPv6 Addresses ::/96,
    // and IPv4-mapped IPv6 addresses ::ffff:0:0/96
    ::/80;
    // IPv6 Link local
    fe80::/10;
    // RFC 6052
    64:ff9b::/96;
} except-from { "Your.Domain"; };
deny-answer-aliases { "Your.Domain"; };

It's probably not a good idea to exclude 127.0.0.0/8 as it is often used by services like spam block lists.