DNS Proxy Firewall IP Clearance for Dynamic Walled Gardens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing walled garden systems face issues with browser certificate errors when users attempt to access HTTPS websites, and they do not allow access to sites using protocols other than HTTP, such as Telnet or FTP, even if the administrator adds the hostname to the cleared sites list, due to frequent IP address changes and lack of proper certificate handling.
Innovation Solution
A DNS proxy-based walled garden system that redirects all DNS traffic to a controller, which matches hostname lookups with configured cleared hosts, checks if the IP addresses are cleared through the firewall, and adds newly resolved IP addresses to the cleared list, allowing access for any protocol without hindrance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the walled garden system uses a static cleared sites list with IP addresses, then access control is simple and reliable, but it cannot handle frequent IP address changes of HTTPS websites and causes browser certificate errors
Solution Approach 1:
The system dynamically updates the cleared sites list by intercepting DNS queries, resolving domain names to IP addresses, and automatically adding newly resolved IP addresses to the cleared list. This dynamic mechanism allows the system to adapt to frequent IP address changes of HTTPS websites while maintaining reliable access control through automated firewall rule updates.
Solution Approach 2:
The system implements a feedback loop where DNS query interceptions provide information about domain name resolutions, which then triggers automatic updates to the cleared sites list and firewall rules. This feedback mechanism ensures that the access control system continuously adapts to current IP address assignments while maintaining security policies.
2Device complexity
If the walled garden system blocks access to non-HTTP protocols, then security control is simpler, but it prevents access to Telnet, FTP, and other protocols even when hostnames are added to the cleared sites list
Solution Approach 1:
The system provides universal access control that works across multiple protocols (HTTP, HTTPS, Telnet, FTP, and others) by implementing a protocol-agnostic DNS query interception mechanism. The same DNS proxy and firewall rule update infrastructure serves all protocols, eliminating the need for protocol-specific access control configurations while maintaining comprehensive security.
3Measurement precision
If the system manually maintains cleared IP addresses lists, then access control is precise, but it requires administrator knowledge of all sub domains and IP addresses in advance
Solution Approach 1:
The system performs self-service by automatically intercepting DNS queries from user devices, resolving domain names to IP addresses, and populating the cleared sites list without administrator intervention. This automated self-service mechanism eliminates the need for administrators to manually know or configure all sub domains and IP addresses, while maintaining precise access control through automated firewall rule generation.
Solution Approach 2:
The system performs preliminary DNS resolution and IP address discovery before users attempt to access resources. By intercepting and processing DNS queries in advance, the system proactively populates the cleared sites list with necessary IP addresses, ensuring that access control decisions can be made immediately without requiring administrator pre-configuration of all possible targets.
4Ease of operation
If the system accepts all DNS queries from non-logged-in users, then guest access is more convenient, but it exposes the network to potential security risks from unauthorized access attempts
Solution Approach 1:
The DNS proxy acts as an intermediary between non-logged-in users and the external DNS infrastructure. It intercepts and filters DNS queries, allowing only those for domains that resolve to IP addresses subsequently added to the cleared sites list. This intermediary mechanism enables convenient guest access while maintaining network security by blocking unauthorized access attempts at the DNS resolution stage.
Data Source
AI summary
A walled garden system includes a firewall controlling access between a first network and a second network at least by allowing connection requests originating from a user device on the first network to a destination IP address on the second network in response to determining that the destination IP address matches a cleared IP address on a cleared IP addresses list. A controller receives a domain name service (DNS) reply from a DNS server on the second network, and determines whether a domain name specified within the DNS reply matches a cleared domain name on a cleared domain names list. In response to determining that the domain name specified within the DNS reply matches the cleared domain name on the cleared domain names list, the controller adds a resolved IP address specified in the DNS reply to the cleared IP addresses list as a new cleared IP address.