This document describes the integration process of the ISC Bind 9 ThreatSTOP DNS Firewall server running on TSCM.
Setup proceedure summary:
- Open a ThreatSTOP account if you have not already done so.
- Using the Portal, configure a new device - Manufacturer: ISC and Model: BIND 9 (TSCM)
tsadmin addcommand to create the device. The device will automatically configure itself. (untouched Bind configuration files backed up to
- Configure the client machines to be protected to use the ThreatSTOP DNS Firewall for address resolution.
|Operating System||OS Provided Bind Version|
|Ubuntu 16.04||BIND 9.10.3 Security Changelogs|
You will need the following two sets of settings to complete the installation. You can retrieve the RPZ Zone name, Policy TSIG Key name, Policy TSIG Key secret and Device ID via the settings of the device in the Admin Portal.
The ThreatSTOP TSCM Bind DNS Firewall requires a system that meets at least these specifications.
- 2 GB of RAM
- 10 GB of disk space
- Time synchronized (NTP)
To retrieve its configuration and policy, and to upload log data, the machine needs the following connectivity:
- DNS over UDP (Internal Clients -> DNS Firewall Device)
- Inbound UDP port 53 [or whatever port you specify]
- DNS over TCP
- IP Range: 220.127.116.11/24
- Outbound TCP port 53
- Hostname: logs.threatstop.com
- IP range: 18.104.22.168/28
- Outbound TCP port 443
- Outbound UDP port 123
The following steps will walk you through adding the ThreatSTOP TSCM Bind DNS Firewall device.
ThreatSTOP Portal setup
- If you want to use a custom DNS Firewall policy, please read DNS Firewall Policies
- Create a new Device Entry: Click on Devices and then on Add Device.
- The Manufacturer is: ISC
- The Model is: BIND 9 (TSCM)
- TSCM Bind (This will create your policy and TSIG keys, you will continue the installation on the TSCM via command line wizard)
- Select the DNS Firewall policy - either a pre-defined policy or a custom policy
- Note: It can take up to 30 minutes for a new device to become available after it is created in the Portal. Once the device is available, its IP address will be recognized in the output of the following command:
The Admin Portal will display a form to enter the device settings described below and the links to retrieve the TSCM image.
Nickname: This is a mnemonic name used to identify the device. It can be set to any string (A-Z, 0-9, - and _). If you create multiple device entries, each entry must have a unique nickname. The Nickname will be used to identify the device on the TSCM and in the Reporting user interface.
Policy: Select a pre-defined policy or a customized policy. It must be an IP Defense Policy.
IP Type: Access to the ThreatSTOP services is controlled in part using an ACL allowing the device IP to connect. If your device has a static public IP address (the most common case), select static. If your device has a dynamic public IP address, the ThreatSTOP services can lookup the IP address using a DNS fully-qualified name (FQDN).
Public IP address: In static mode, this is the public IP address of the TSCM. It is possible to configure multiple device entries with the same public IP address.
Note: An optional field to store a note of your choice about the device - location, identifiers, model…
Adding ISC Bind Device - TSCM CLI
You will be prompted for all required device settings listed below.
$ tsadmin add --type bind [device nickname]
TSCM CLI required settings
ThreatSTOP Portal Device Settings
|Device ID||Retrieved from device settings|
|RPZ Zone Name||Retrieved from device settings|
|Policy TSIG Key Name||Retrieved from device settings|
|Policy TSIG Key Secret||Retrieved from device settings|
Bind specific settings
|Trusted ACL||Addresses allowed to query this DNS server. Space separated special Bind keywords (all, localhost, localnets), IP(s) or CIDR addresses i.e. 192.168.2.0/24 10.0.0.1.|
|Bind Port||The TCP port the TSCM should use for listening for DNS requests|
|Bind Mode||Bind mode of operation (1 = Recursion only, 2 = Forwarder only)|
|Bind Forwarders||(only if Bind mode set to forwarder only) Space separated DNS server IP addresses used to forward upstream queries i.e. 192.168.1.1 10.0.0.1|
The TSCM device will produce Bind configuration files with the supplied settings after the setup wizard completes.
Testing / Troubleshooting your configuration
You can test the RPZ policy is working correctly by verifying a known blocked address like bad.threatstop.com returns NXDOMAIN. Below is an example of running with the DNS Utility dig.
dig @[Bind Server IP or Hostname] bad.threatstop.com ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 5611 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 2
Below is an example using nslookup, found natively on Windows machines.
C:\Users> nslookup bad.threatstop.com [Bind Server IP or Hostname] Server: [Bind Server Hostname] Address: [Bind Server IP]#53 ** server can't find bad.threatstop.com: NXDOMAIN
Looking up a non-restricted website like google.com should return it’s current IP. You can repeat this on any client using this device as a DNS server.
- Check that a log entry was added to
- You can test connectivity to ThreatSTOP by running:
$ curl https://www.threatstop.com/cgi-bin/validip.pl Your IP address: <ip address> Address is in the list of authorized hosts
You can verify the Bind configuration has no major syntax errors by running