On 2018-08-27 16:09, Jeremy Baker via Unbound-users wrote:
On 08/17/2018 04:48 PM, Rick van der Zwet via Unbound-users wrote:
...
For debugging purposes, I am trying to block (only) AAAA queries from
a specific domain and it's subdomains.
...
Does somebody has a work-around available to make my debugging effort
easier?
This would certainly make my life easier as well, since netflix is
constantly adding new host names that I have to disable ipv6 for.
Ales suggested dnsdist [1] in front of the unbound instance. It works
fine for me, using the following configuration:
# cat /usr/local/etc/dnsdist.conf
-- Disallow Netflix AAAA queries
addAction(AndRule({RegexRule("netflix.com$"), QTypeRule(dnsdist.AAAA)}),
RCodeAction(dnsdist.NXDOMAIN))
-- All other traffic to local Unbound instance (interface:
127.0.0.1@5353)
newServer("127.0.0.1:5353")
-- Local Network configuration
setLocal('127.0.0.1:53')
setACL('127.0.0.0/8')
addLocal('192.168.178.1:53')
addACL('192.168.178.1/24')
addLocal('[2001:984:ac89:ffff::1]:53')
addACL('2001:984:ac89::/48')
addLocal('172.17.107.20:53')
addACL('172.16.0.0/12')
How-ever a patch supporting wildcard domains in local-data would also be
appreciated :-)
Best regards,
-Rick
[1] https://dnsdist.org
