Re: Are there security downsides to allowing outgoing Internet DNS queries?

[Bennett Todd]

1999-03-02-22:59:24 Larry Cannell:
> I can appreciate the concern you have regarding DNS. I am wondering how
> would you support applications that NEED the DNS information (apps like
> NetMeeting which does not have proxy support and needs to connect to any
> number of external data conference servers).

Easy: I don't allow them through high-security firewalls. If their
availability were presented as a requirement, I'd place a client machine on
which to run the netmeeting client app on the DMZ, and set up ssh tunnels to
that sacrificial client through the high-security firewall.

Apps for which no proxy is available and which have no documented security
design do not go through the high-security firewall.

-Bennett
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]