Block outgoing DNS traffic from B&R Server

[david.brunner]

Dear all,

this is more related to Configuration recommendation for the Windows Server setup itself.

The B&R server (standalone) is supposed to be out of domain as standalone in a separate network with no (almost none) access to the global Internet.

In my case, I see a server still doing a lot of outgoing requests to public IPs for Internet Service of
Microsoft-Office365.Published (resolving to for example 20.190.159.68)
Microsoft-Azure.Front.Door
Microsoft-Azure
Microsoft-Office365
Dell-NTP
...
--> I presume most of this is "telemetry"

It is blocked on the firewall, preventing it from leaving the premise.
Do you block this traffic otherwise? or prevent it from even starting by using policies, stopping service and so on?

How do you handle this?

thanks and best regards,
David

[david.domask]

Hi David,

Since it's not really a Veeam question will wait to see if others share their commentaries/strategies; I would personally assume most are just blocking elsewhere in the infrastructure since from experience, updates tend to re-enable such services, but this is just a guess based on my experience handling such things on a personal machine. I think it would just make more sense to prevent such traffic than having to wonder if an update re-enabled the service again.

[david.brunner]

Hi David,

thanks for answering. Yes, it is not really a "Veeam" question, but related to a server using veeam so I thought, there are others here, facing the same. And I also think, most have these requests on their firewall and might block them.
But since it is an open forum, I had hoped some might share their experience, since we in IT are all in similar situations.

And agreed, I preventing unwanted traffic is better than blocking it. But software changes and it will finde another way, so...

just had hoped for some tips without bothering anyone =)

[david.brunner]

Hi,
I guess this is too off-topic. I apologize for that

I guess most will either live with all the log entries on the Firewall. Or configure Windows telemetry and else individually for the host
Or install a local DNS Blocker / Firewall software that takes care of that

I will look into something OpenSource/Freeware like this

PortMaster
or a Script like this
https://github.com/perplexityjeff/Windows-DNS-AdBlocker

just to close this thread from my side