---
title: "Blocking public DoH servers with NIOS"
canonical: "https://docs.infoblox.com/space/DeploymentGuideDoTDoH/695599185/Blocking%20public%20DoH%20servers%20with%20NIOS"
format: markdown
---
This section of the guide covers how to block public DoH servers with NIOS. Blocking Public DoH feeds on NIOS requires the configuration of a Distribution server on BloxOne, adding NIOS members to BloxOne, and the creation of an RPZ in NIOS.

Alternatively, if you have the appropriate BloxOne licenses, blocking public DoH servers can be accomplished via the DNS Forwarding Proxy and a BloxOne Security Policy that includes the Public_DOH and Public_DOH_IP feeds. A guide on how to configure the DNS Forwarding proxy can be viewed [here](https://docs.infoblox.com/space/BloxOneDDI/186876333/Configuring+DNS+Forwarding+Proxy+and+BloxOne+DDI+DNS).   

## **License and Configuration Requirements **

To deploy remote RPZ feeds, you will need a Grid member with at least a DNS and RPZ license. 

To obtain the feeds, your member will need access to our Threat Intelligence Feed servers on port 53 (UDP and TCP) as the feed data is transferred through a DNS zone transfer. Your server will also need to be able to perform recursion to obtain a response from the Internet. 

To review log hits, you need to enable on the member or grid level the RPZ logging category (grid settings, toggle advanced, logging, check RPZ)

## **Configuring NIOS to download the DoH feed**

Navigate to **Policies **→ **On-Prem DNS Firewall** to configure the On-Prem DNS Firewall service. Complete the four-step process to configure your On-Prem DNS Firewall settings. Please note, downloading the Infoblox Threat Intelligence Feed Deployment Guide is Step 1 of the process. Once you have reviewed the guide, please proceed to Step 2 to begin the configuration process.

1. Click **Download Deployment Guide**. Read through the guide thoroughly before proceeding to the next step where you will configure your NIOS feeds.
2. **Feed Configuration**

![image](media://642a0599-0840-42fc-9263-bfad62f6fb89)

Click **Feed Configuration Values** to configure the NIOS feed values with the provided feed addresses based on your subscription. Copy these values to a text editor as you require them later for NIOS configuration. Please note, the record count associated with a feed is published along with the feed’s description. Once completed, click **Close** and proceed to Step 3. 

![image](media://6c7bece0-a773-4a95-a700-9f8ccf6451aa)


3. **Distribution Server Configuration Values**

Click **Distribution Server Configuration Values** to configure your distribution servers. Both IPv4 and IPv6 IP addresses may be used to serve your feeds, depending on your specific requirements. TSIG Key encryption algorithms supported include HMAC MD5 512-bit and HMAC 256 256-bit. Please be aware; it may take up to one hour before your newly created TSIG keys become active. 

- To set up how your feeds are distributed, complete the following steps:
- On the Distribution Server Details screen, for **BLOXONE HITS RPZ FEED**, toggle the switch to Enable to add the option of a custom RPZ feed to the feed distribution. When enabling the custom RPZ feed, specify the maximum number of feed indicators the custom RPZ feed will return along with and an expiration date for the indicators.
- Select either the **IPv4** or **IPv6** IP options for both the US West Distribution and the East Distribution Servers.
- **Copy** and **save** your selected IP addresses. You will need them later when configuring NIOS.
- Select a **TSIG Key algorithm** from among the drop-down menu choices. Algorithm choices include HMAC MD5 512-bit and HMAC 256 256-bit. Once you have made your selection, click **Generate **to generate a new TSIG key.
- **Copy** and **save** the **Key Name** and **TSIG Key**.
- Once completed, click **Close** and proceed to Step 4.

![image](media://5a0c7be0-89bb-4eaa-8654-527db58878ce)

4. **Configuring Threat Feed Retrieval Members **

Click **Configure Members** to configure your list of threat retrieval members. You can add and remove members as suits your needs. To add a threat retrieval member, complete the following steps: 

- Click **Add**. A new row will populate at the bottom of the list.
- Select the new row by selecting the box next to it.
- In the **NAME** field, add a name for the member you are adding.
- In the **IP ADDRESS** field, add the IP address you want to use for the new member.
- Once you have finished adding members, you can remove any members you will not be using.

To remove a threat retrieval member, complete the following steps: 

- Select the configured member you want to remove by selecting the box next to it.
- Click **Remove**.

Once you have configured your threat retrieval members, click **Save & Close**. 

![image](media://55c4bffa-f5c8-4755-a081-b0a7473fdbd4)

This completes the Cloud Services Portal, On-Prem DNS Firewall portion for the setup and configuration of Infoblox Threat Intelligence feeds. Please proceed to the next page to configure NIOS. 

## Adding RPZ Feeds to NIOS

In NIOS navigate to: “**Data Management**” →  **DNS** →  “**Response Policy Zones**” Press the **+** button or use “**Add**” in the sidebar. 

1. Select ‘**Add a Response Policy Zone Feed**’ then press **Next**.

![image](media://8f49e75f-1287-4434-87bd-6e0ffa8e8c6b)

2. **Add** the feed you want to use. In the case of DoH feeds, choose **Public_DOH** and **Public_DOH_IP**.

Note that each feed is a subset of the data, and deploying multiple feeds is required to cover all bases. You will have to repeat these steps for each RPZ. 

![image](media://537c3fc7-f01d-419d-b282-294fad1c0cb6)

- Leave Policy override on “**None (Given)**” for now. For the other policy override settings, please refer to the Admin Guide.
- Modify logging Severity if needed
- Press **next**


3. Add the **External Primary**

Use the drop-down next to the **“+”** sign to select External Primary 

![image](media://875e7f87-f94e-4807-8300-60f64cd9f2cc)

4. Define the **External Primary’**s settings

Refer to the portal for the values from your account. Select the nearest name server and use the values you copied from CSP during feed configuration. Note that the name field is only for reference purposes and you can use any name you choose to.

5. **Add** a **Grid Secondary**

![image](media://581a743c-ff4e-4ad1-a7b5-ff66c4c74b53)

- Use “**Select**” to select which member(s) you want to add or use “All recursive servers” if you want to add all recursive nodes with an RPZ license.
- Note that you can configure a single secondary to be “Lead secondary.” If you set this up, that member will be the only one to reach out to the external primary. You will then redistribute the feed internally between your members through zone transfers.
- Press **Add**
- Press **Save** and **Close**, restart services as required (use the banner at the top)
- Give services 5 minutes to fetch the zone. If you refresh the GUI, you will see the last updated value for when the last transfer was successful.

### **Testing the Configuration **

1. Navigate to the **Data Management** → **DNS** → **Response Policy Zones**.
2. Find the Public_DOH or Public_DOH_IP feed.
3. Click on one of the feeds to export to a **.csv** file.
4. Pick an entry from the **.csv** file.
5. Run **nslookup** or **dig** against the member with the IP address or name.
6. Check the syslog for security hits. You should see a CEF entry with the domain(s) you are testing. You can also refer to the security dashboard for graphed out results based on the last 30 minutes of traffic.

![image](media://4d9dd46a-e35e-45dc-a8ef-303175a550be)

## **Troubleshooting **

In case you are not getting a feed from our servers, verify the following: 

- You used the correct feed name
- Your time is set correctly (ntp should be used)
- You use the right key name, TSIG key, and algorithm

For further troubleshooting, check the syslog of your (lead) secondary for a message that includes “transfer.”