Hello,
is it possible with unbound to allow only lookups on whitelisted
domains and answer all others with 127.0.0.1 or NXDOMAIN?
for example (precedence: white is stronger than black)
blacklist *
and
whitelist google.com and linux.org (and subdomains of them).
The lookups for the whitelisted domains should go external (recursive) and not to
a local zone file.
greetings
Carsten
16.05.2010 22:01, Carsten Krüger wrote:
Hello,
is it possible with unbound to allow only lookups on whitelisted
domains and answer all others with 127.0.0.1 or NXDOMAIN?
No.
2010/5/16 Alexander E. Patrakov <patrakov@gmail.com>
16.05.2010 22:01, Carsten Krüger wrote:
Hello,
is it possible with unbound to allow only lookups on whitelisted
domains and answer all others with 127.0.0.1 or NXDOMAIN?No.
Well, I wouldn’t be so strict, something like this could probably be done using forwarding:
name: whitelist1.dom
forward-addr: 1.2.3.4
name: whitelist2.dom
forward-addr: 1.2.3.4
name: .
forward-addr: <ip_of_dummy_nameserver_returning always nxdomain, f.e. running on 127.0.0.2>
But you are doing it wrong. DNS is a bad place for this kind of filtering. Implement transparent HTTP proxy with block list or even simple firewall rules are better. Protection on DNS level is very fragile and probably could be easily circumvented if not implemented together with strict firewall rules.
Ondrej
Hello,
Well, I wouldn't be so strict, something like this could probably be done
using forwarding:
name: whitelist1.dom
forward-addr: 1.2.3.4
name: whitelist2.dom
forward-addr: 1.2.3.4
name: .
forward-addr: <ip_of_dummy_nameserver_returning always nxdomain, f.e.
running on 127.0.0.2>
Thanks.
Implement transparent HTTP proxy with block list or even simple firewall
rules are better.
Not trivial on single windows workstation.
Protection on DNS level is very fragile and probably could
be easily circumvented if not implemented together with strict firewall
rules.
I know.
greetings
Carsten
Hi Carsten,
Not sure if that is a good idea, but unbound can be configured like
that. Here the local-data config is used (so no need to run another
nameserver).
# this redirects everything to 127.0.0.1
local-zone: "." redirect
local-data: ". IN A 127.0.0.1"
# override for whitelisted domains to resolve normally
local-zone: "google.com" transparent
local-zone: "linux.org" transparent
The local-zone statements are checked and the closest match determines
what happens to the query.
Ondrej suggests to use forward and stub configs, and that works too,
since it also uses the config from the closest match on the query.
Best regards,
Wouter
Hello,
# this redirects everything to 127.0.0.1
local-zone: "." redirect
local-data: ". IN A 127.0.0.1"
# override for whitelisted domains to resolve normally
local-zone: "google.com" transparent
local-zone: "linux.org" transparent
That's a more pretty solution.
Thanks again.
greetings
Carsten