3 ms·

I know my corporate firewalls do not allow connections to bare ip addresses. This allows me to bypass that check for things I haven't assigned names to already.

• yathna 7y ago
  this makes no sense -- all tcp connections are already to the "bare ip address". dns lookup happens independently of the ip connection. in the case of a browser, your browser asks the local resolver (or with doh, remote nameserver) what the ip is for a given domain, then connects to that ip. I suppose it's possible your network has some strange setup that pokes holes through the firewall based on dns requests, but that would be obscenely expensive both computationally and financially.
  • clwg 7y ago
    The simplest implementation of this would be to block all outbound traffic for all hosts by default, and allow only web traffic out through a proxy. Then for other specific services poke holes for specific src<->dst.
  • icedchai 7y ago
    He probably means his corporate proxy servers, not firewalls.
    • sleepybrett 7y ago
      indeed, sorry.
  • clinta 7y ago
    The firewall or proxy is probably looking at the HTTP host header, and blocking requests with an IP there.