# US 12,010,096 B2 · Dynamic firewall configuration > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,096 B2 - Document ID: US12010096B2 - Status: Granted - Kind: B2 - Application number: 18/296,702 - Filed: 2023-04-06 - Published: 2023-12-07 - Granted: 2024-06-11 - Earliest claimed: 2018-02-09 - Assignees: Comcast Cable Communications, LLC - Applicants: Comcast Cable Communications, LLC - Inventors: Alexander Gurney - Web page: https://patentgrep.com/patent/US12010096B2 ## CPC - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0263: {Rule management} - H04L 63/0281: {Proxies} - H04L 63/101: {Access control lists [ACL]} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L 61/4511: using domain name system [DNS] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed are systems and methods for firewall configuration. A request can be transmitted to a DNS server. A response to the DNS request can include an Internet Protocol (IP) address. A firewall rule can be generated permitting access to the IP address. The firewall rule can be configured to be valid until expiration of a time-to-live value in the response to the DNS request. Thus, firewall rules can be automatically created as needed by executed processes, eliminating the need for manual firewall rule creation. As the firewall rule is invalid after the expiration of the time-to-live value, risks associated with maintaining out-of-date firewall rules are eliminated, as is the requirement to manually remove or modify out-of-date firewall rules. ## Claims ### Claim 1 A method comprising: receiving, by a user device, based on a first domain name system (DNS) request comprising a uniform resource locator (URL), a response comprising a first Internet Protocol (IP) address associated with the URL and a time-to-live; determining, based on an expiration of the time-to-live, that access to the first IP address is restricted; sending a second DNS request; and generating, based on the second DNS request, a firewall rule, wherein the firewall rule permits access to a second IP address associated with the URL. ### Claim 2 (depends on 1) The method of claim 1, further comprising sending the first DNS request to a DNS server. ### Claim 3 (depends on 2) The method of claim 2, wherein one or more of the first DNS request or the second DNS request identifies the DNS server, and wherein the method further comprises determining that the DNS server is included in a white list of one or more DNS servers. ### Claim 4 (depends on 3) The method of claim 3, wherein sending the first DNS request to the DNS server comprises sending, to the DNS server and based on determining that the DNS server is included in the white list of one or more DNS servers, the first DNS request. ### Claim 5 (depends on 1) The method of claim 1, wherein a source of the first DNS request comprises a process executed on the user device. ### Claim 6 (depends on 1) The method of claim 1, further comprising receiving, by a proxy service executed on the user device, one or more of the first DNS request or the second DNS request. ### Claim 7 (depends on 1) The method of claim 1, wherein the second DNS request is sent based on determining access to the first IP address is restricted. ### Claim 8 (depends on 1) The method of claim 1, wherein generating the firewall rule comprises generating, via a firewall service, the firewall rule. ### Claim 9 (depends on 1) The method of claim 1, further comprising determining that the URL is included in a white list of one or more URLs. ### Claim 10 (depends on 9) The method of claim 9, further comprising sending, to a DNS server and based on determining that the URL is included in the white list of one or more URLs, the first DNS request. ### Claim 11 (depends on 1) The method of claim 1, wherein generating, based on the second DNS request, the firewall rule comprises: receiving, based on the second DNS request, a second response comprising the second IP address associated with the URL and a second time-to-live; and generating, based on the second response, the firewall rule. ### Claim 12 A method comprising: receiving, by a firewall service, based on a first domain name system (DNS) request comprising a uniform resource locator (URL), a response comprising a first Internet Protocol (IP) address associated with the URL and a time-to-live; generating, based on the response, a first firewall rule, wherein the first firewall rule permits access to the first IP address until the time-to-live expires; restricting, based on an expiration of the time-to-live, access to the first IP address; receiving a second DNS request; and generating, based on the second DNS request, a second firewall rule, wherein the second firewall rule permits access to a second IP address associated with the URL. ### Claim 13 (depends on 12) The method of claim 12, further comprising sending the first DNS request to a DNS server, wherein the response is received from the DNS server based on the first DNS request. ### Claim 14 (depends on 12) The method of claim 12, wherein generating the first firewall rule comprises permitting access to the first IP address by network traffic originating from a process executed on a user device. ### Claim 15 (depends on 12) The method of claim 12, wherein the second DNS request is received from a user device based on determining that access to the first IP address is restricted. ### Claim 16 (depends on 12) The method of claim 12, wherein generating the second firewall rule comprises permitting access to the second IP address by network traffic originating from a process executed on a user device. ### Claim 17 (depends on 12) The method of claim 12, further comprising: receiving, by the firewall service, a third DNS request; determining that the third DNS request was not received from a proxy service; and blocking the third DNS request. ### Claim 18 (depends on 12) The method of claim 12, wherein generating, based on the second DNS request, the second firewall rule comprises: sending, to a DNS server, the second DNS request; receiving, based on the second DNS request, a second response comprising the second IP address associated with the URL and a second time-to-live; and generating, based on the second response, the second firewall rule. ### Claim 19 (depends on 12) The method of claim 12, further comprising rejecting, by the firewall service, network traffic to the second IP address from a service other than a process executed on a user device. ### Claim 20 A method comprising: receiving, by a proxy service, based on a first domain name system (DNS) request comprising a uniform resource locator (URL), a response comprising a first Internet Protocol (IP) address associated with the URL and a time-to-live; sending, to a user device, the response; receiving, based on an expiration of the time-to-live, a second DNS request; and causing, based on the second DNS request, a firewall service to generate a firewall rule, wherein the firewall rule permits access to a second IP address associated with the URL. ### Claim 21 (depends on 20) The method of claim 20, further comprising determining a port associated with the firewall rule. ### Claim 22 (depends on 20) The method of claim 20, wherein the second DNS request is received from the user device based on determining that access to the first IP address is restricted, wherein access to the first IP address is restricted based on an expiration of the time-to-live. ### Claim 23 (depends on 20) The method of claim 20, further comprising blocking, by the firewall service, DNS requests not sent by the proxy service. ### Claim 24 (depends on 20) The method of claim 20, wherein the time-to-live comprises at least one of: a time duration, a time value, or a date. ### Claim 25 (depends on 20) The method of claim 20, further comprising: determining, by the proxy service, that a third DNS request is not associated with a white list; and sending, based on the third DNS request, an error indication. ### Claim 26 (depends on 25) The method of claim 25, wherein the white list identifies one or more allowed DNS servers or one or more allowed domain names associated with the third DNS request. ### Claim 27 (depends on 20) The method of claim 20, wherein causing the firewall service to generate the firewall rule comprises sending, to the firewall service, instructions to generate the firewall rule. ### Claim 28 (depends on 20) The method of claim 20, wherein causing, based on the second DNS request, the firewall service to generate the firewall rule comprises: sending, to a DNS server, the second DNS request; receiving, based on the second DNS request, a second response comprising the second IP address associated with the URL and a second time-to-live; and generating, based on the second response, the firewall rule.