DNS proxy that automatically clears IP addresses in firewall according to DNS queries of cleared domain names

A method performed by a domain name system (DNS) proxy in a walled garden system, the method comprising:

• storing a cleared domain names list;
• receiving a DNS request sent by a non-logged in user device on a first network;
• proxying the DNS request to an external DNS server as a proxied DNS request sent on a second network;
• receiving a DNS reply from the external DNS server on the second network, the DNS reply being a reply to the proxied DNS request;
• determining whether a domain name specified within the DNS reply matches any cleared domain name on the cleared domain names list;
• and
• in response to determining that the domain name specified within the DNS reply matches a cleared domain name on the cleared domain names list, a) dynamically reconfiguring a firewall controlling access between the first network and the second network to ensure a resolved IP address specified in the DNS reply is included in a cleared internet protocol (IP) addresses list in the firewall, and, after ensuring the resolved IP address is included in the cleared IP addresses list in the firewall, b) proxying the DNS reply back to the non-logged in user device via the first network;
• wherein the firewall is operable to control access between the first network and the second network at least by receiving one or more connection requests originating from the non-logged in user device on the first network that have a destination IP address on the second network, directly allowing the connection requests to pass to the destination IP address on the second network in response to the firewall determining that the destination IP address matches a cleared IP address on the cleared IP addresses list, and by blocking other connection requests originating from the non-logged in user device to an other destination IP address on the second network in response to the firewall determining that the other destination IP address does not match any cleared IP address on the cleared IP addresses list.

A non-transitory processor-readable medium comprising a plurality of processor-executable instructions that when executed by one or more processors cause the one or more processors to perform steps of:

• storing a cleared domain names list;
• receiving a DNS request sent by a non-logged in user device on a first network;
• proxying the DNS request to an external DNS server as a proxied DNS request sent on a second network;
• receiving a DNS reply from the external DNS server on the second network, the DNS reply being a reply to the proxied DNS request;
• determining whether a domain name specified within the DNS reply matches any cleared domain name on the cleared domain names list;
• and
• in response to determining that the domain name specified within the DNS reply matches a cleared domain name on the cleared domain names list, a) dynamically reconfiguring a firewall controlling access between the first network and the second network to ensure a resolved IP address specified in the DNS reply is included in a cleared internet protocol (IP) addresses list in the firewall, and, after ensuring the resolved IP address is included in the cleared IP addresses list in the firewall, b) proxying the DNS reply back to the non-logged in user device via the first network;
• wherein the firewall is operable to control access between the first network and the second network at least by receiving one or more connection requests originating from the non-logged in user device on the first network that have a destination IP address on the second network, directly allowing the connection requests to pass to the destination IP address on the second network in response to the firewall determining that the destination IP address matches a cleared IP address on the cleared IP addresses list, and by blocking other connection requests originating from the non-logged in user device to an other destination IP address on the second network in response to the firewall determining that the other destination IP address does not match any cleared IP address on the cleared IP addresses list.