I've been trying to find a way to block the WKS query type from our bind servers.
We have found that is is extensively used by tunneling software.
I tried using RPZ but i'm not sure on how to block a query type instead of domain.
However there seems to be no formal way of disabling a specific type.
Any ideas?
PS, i could use iptables but i'm unsure about the load on the systems
