It should be possible to configure a list of IPs synapse will not make outbound connections to

[richvdh]

We have url_preview_ip_range_blacklist, but no equivalent for federation requests. The attack surface is of course much smaller, but I still don't like the idea of my synapse going and hitting random HTTP servers within my firewall because someone pointed a DNS record at them. In particular, it's currently possible to make synapse send requests back to itself with a DNS record which resolves to 127.0.0.1

[richvdh]

fixed by #5043

[rubo77]

Is it possible to blacklist a domain like this? I got thousands of warnings in my log about a domain, that is not reacheable any more

[anoadragon453]

@rubo77 We don't support blacklisting a domain (yet), but if you can resolve the DNS to an IP address you should be able to add it to ip_range_blacklist to prevent outbound requests.

Alternatively it could be blocked at the firewall level.

[rubo77]

I guess there is no use to block a domain, that is not reacheable anyway.

I tried this:

1. I resolve the domain ffpoe.info localy in my /etc/hosts file to a dummy IP 10.13.13.13 (that is not reacheable either)
2. then I blacklist that IP in ip_range_placklist` and restarted synapse

But this didn't have any effect, I still get errors like

22 06:25:24 localhost matrix-synapse[3903]: 2021-06-22 06:25:24,495 - synapse.handlers.device - 861 - WARNING - _maybe_retry_device_resync-0- Failed to handle device list update for @joachim.stampfer:fpoe.info: Failed to send request: DNSLookupError: DNS lookup failed: no results for hostname lookup: fpoe.info.