Network security question: How are people restricting outbound connections based on DNS names?
For example: Server A wants to connect to cdn.network.com, and that can resolve to a huge range of IPs, so not feasible to allow list all possible outbound connections.
I vaguely remember some dns proxy / firewall magic where it tracks the answer and opens up the IP.
Any hints welcome!
#InfoSec #NetSec
Jeff Moss
npub12t…6x422
2026-10-07 09:48:42 UTC
Author Public Key
npub12tscz5mexfzcp4l6a7e798a705wf4msqjp668xx6jwvwz8n2qqaqy6x422Seen on
wss://relay.momostr.pinkPublished at
2026-10-07 09:48:42 UTCEvent JSON
{
"id": "4e12c069521fa4655e4814857b9f78d4a4389284506f91c3a80addeded7c9512",
"pubkey": "52e1815379324580d7faefb3e29fbe7d1c9aee009075a398da9398e11e6a003a",
"created_at": 1791366522,
"kind": 1,
"tags": [
[
"t",
"netsec"
],
[
"t",
"infosec"
],
[
"proxy",
"https://defcon.social/@thedarktangent/117398996448993205",
"web"
],
[
"proxy",
"https://defcon.social/users/thedarktangent/statuses/117398996448993205",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://defcon.social/users/thedarktangent/statuses/117398996448993205",
"pink.momostr"
],
[
"-"
]
],
"content": "Network security question: How are people restricting outbound connections based on DNS names?\n\nFor example: Server A wants to connect to cdn.network.com, and that can resolve to a huge range of IPs, so not feasible to allow list all possible outbound connections. \n\nI vaguely remember some dns proxy / firewall magic where it tracks the answer and opens up the IP. \n\nAny hints welcome!\n#InfoSec #NetSec",
"sig": "4c4042e6938a702db1415190310bb340b39a70e5b1cd3f9c28e7075577ebe61b7926fc3fa95433953d34adafb35b5f85a6c1de3c0119bcbac6eff4972b8f2980"
}