Subject: [Mud] MUD file for DNS probes, avoiding non-public address space

From: Michael Richardson <[email-masked]>
Date: Fri, 20 Sep 2019 13:18:52 -0400

The RIPE Atlas probes do distributed DNS monitoring.
There is a lot that a MUD file could do to restrict other unwanted traffic,
even if we have to write an ACL allowing traffic to 0.0.0.0/0 port 53.

In IPv6, it's more properly 2000::/3 port 53, which nicely rules out
DNS traffic to ULAs, link-locals, multicast, mapped IPv4 and default NAT64
space, etc.
{If 4000::/3 gets deployed by IANA, I think we'll have decades of notice}

Maybe 0.0.0.0/0 should really read:
  0.0.0.0/5     (0.0.0.0 -> 7.255.255.255)
  8.0.0.0/7     (8.0.0.0 -> 9.255.255.255)
                omitted 10.0.0.0/8
  11.0.0.0/8
  12.0.0.0/6
  16.0.0.0/4
  32.0.0.0/3
  64.0.0.0/3    (64.0.0.1 - 95.255.255.254)
  96.0.0.0/6    ... you get the idea.

quite annoyance.

So, what we want is to whitelist 0.0.0.0/0 and then blacklist RFC1918 and
100.64.0.0/10, and class D space.  (maybe not class E space)
I have to back to the document to remember if we can actually do plus and
minus, etc.

Maybe there should be a macro for this?

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-