Questions about unresolvable IP addresses

Hello,

I have been reading where many system administrators have decided to block all access to their systems from IP addresses that do not resolve. I have heard and read both sides of the debate and see this as the "golden double-edged sword" where it could be a blessing beyound all or a devistating curse.

I would like input and opinions from AO users. I have been considering this for two years now for my servers seeing that harvesters and spammers tend to proliferate in the unresolvable blocks.

Any input on this issue is greatly appreciated. Thank you in advance.

It's silly.... half the internet doesn't "resolve"... You cut off an entire userbase if you do.... But then again, in certain circumstances.. it may not be a bad thing... But the internet is about connectivity not privacy..... in a way... ;)

If you could block certain ports from addresses that don't resolve, you might be onto something ;) That way you could still offer some functionality to the whole world (like the most basic services, depending on what you're trying to accomplish)...

Out of curiosity, what kind of services are you running that you're concerned about? Besides, an address that does resolve in no way gives them any more trustworthiness...

Hello,

At this point, the serverices that rank the highest are email, ftp, web.

Thank you in advance.

Hello,

Considering the issues facing system administrators and users these days, I am surprised in the lack of interest in this issue.

Does anyone even care about the decisions being made about internet connectivity and wheather or not their serverces could be interrupted by admins blocking unresolable IP addresses?

Quote:

---

I am surprised in the lack of interest in this issue.

---

Its not a lack of interest, it is a lack of useable information for anyone to base an educated opinion.

It's not even a lack of usable information. As I said above 50% of the internet is unresolvable. Since you can't determine, (easily), which ones that aren't resolvable are really "valid" you have no choice but to block everything that doesn' resolve.

I did look at blocking access to my public services from certain countries since there would be no conceivable reason for them to need to connect. The result of my "investigation" was that, unfortunately, the netblocks are so fragmented that the amount of work required to effect this kind of proactive action would not be close to being "cost" effective.

That's my $2 on the whole issue.

i dont think that you can see if an ip is "Good" or "Evil" just because it can been resolved to a name.
Examples:
There is tons of ISP dialup providers that has no name resolution. So will you ban a lot of customers just because they cant afford an ADSL?
There is a lot of IPs that have a "name", but they are bad, bad bad. For example, some companies here banned SMTP servers that has IP addresses on adsl (home) range. Why? because spammers use to use those adsl links (cheap) to promote their business.
Maybe in a specific business this kind if IP Ban can fit, but as a generic speach, no.

Hello,

Thank to the people that have responded. Given the slant on this issue being against blocking unresolvable IP addresses, the following questions becon to be asked:

1. Why then is a blanket block on unresolvable IP addresses becoming increasingly popular?

2. Any opinions as to why ISP and the like do not atleast use a resolvable in.arpa reverse resolution? Especially considering that large blocks can be written out with a simple bash script?

Thank you in advance.

Hi Frpeter,

This is not my area of expertise, so I am going on stuff I have heard and read over the past year or so.

I think that cacosapo has a point:

Quote:

---

Maybe in a specific business this kind if IP Ban can fit, but as a generic speach, no

---

I have heard of the practice becoming increasingly used in an e-mail context. That I can sort of understand because of the spam angle.

Cheers

Hi frpeter...interesting post and thread. It makes for good conversation...

Quote:

---

1. Why then is a blanket block on unresolvable IP addresses becoming increasingly popular?

---

Where are you getting your information? I'm not familiar with this being a regular practice, but consider it more of an extreme solution to a problem. Kind of like hitting a nail with a thermonuclear warhead.

Quote:

---

2. Any opinions as to why ISP and the like do not atleast use a resolvable in.arpa reverse resolution? Especially considering that large blocks can be written out with a simple bash script?

---

Hard to say. Some government systems may intentionally not resolve. Also, and I don't know the regulations over this, but many agencies may intentionally not reverse their IP's for the purpose of client privacy and such. Hard to say.

I think it comes down to this...blocking unresolvable IPs is an option. So is instituting a white-list, black-list, ACL, etc. But just because some folks consider it an acceptable solution for THEIR situation (and maybe these folks are championing their position for whatever reason) doesn't make it a panacea for YOUR situation. I would certainly consider it a valid option if you had a limited audience for the services being presented.

For example, my client has an external FTP server specifically for business partners to push and pull (encrypted) data files through. There is a short list of partners who would use this. If we began to see suspicious activity, recon or probe attempts, etc. then instituting a policy like this would probably be a good initial step. Certainly not a complete response, and you have to be mindful of clients being cut off...but its an option.

Personally, I think I have better ways to spend my time and energy actually solving the problem. My $0.02.

Hello,

The readings I have been doing as well as what I heard is from internet security groups and educational and government facilities. I already use this method on my email with excellent results. I have been considering this for my web servers as 99% of the harvesters are coming from unresolable IP addresses.

I see the hits in my web logs, then a day or two later, the emails come. I have been hit with as many as 20,000 emails at once from this tatic. As a small home business, I have tried quite a few methods and definately need something to reduce my load and resources. One particular spam attack put my mail servers with a 5 day backlog of mail with a load of 268 (two hundred and sixty eight).

Just this last week, I caught a spam company out of France attempting to break into my ftp server. Thus far, my firewall (multilayered) is holding. My greatest concern is vulernbilities on legal services.

Thank you in advance.

you are much better off using SPF for your mail, here. it's easy to set up and you can use the GFI the page references to block.... I have found it to be very effective in the last three months of use.

Hello,

I have SPF set up, now for about 4 months. MHO, this is an absolute worthless waste of my hard drive as it did and does NOTHING in stopping spam. My SPF filters register 5% of the spam I get, Blocking unresolable IP addresses stops 99% of my spam.

As an aside on this, I log everything and check constantly to be sure that I am not blocking legal mail. This includes putting all blocked mail into a seperate folder and inspecting on a daily basis.

Quote:

---

2. Any opinions as to why ISP and the like do not atleast use a resolvable in.arpa reverse resolution? Especially considering that large blocks can be written out with a simple bash script

---

I have client who has a single domain, three sites. three DC's/ The sites are connected with vpn usung private addresses. The public ips to all three sites are not resolveable. DNS is set up this way with a bit of security in mind. Their website is hosted on a different ip and server altogether, as well as mail.

Just one illustration.

Hello,

Quote:

---

Originally posted here by bumperspoon
I have client who has a single domain, three sites. three DC's/ The sites are connected with vpn usung private addresses. The public ips to all three sites are not resolveable. DNS is set up this way with a bit of security in mind. Their website is hosted on a different ip and server altogether, as well as mail.

Just one illustration.

---

I use masquerading to hide all my private/internal/web surfing users through a gateway. This gives me a simple reference port that I have DNS entries for while protecting my users. Why wouldn't the same work with your illustration and client?

IMHO, watching one IP address for security issues would be easier then three. Setting up a small clustered firewall I would think would be a better solution for security as you could use IP rotation of the outbound requests.