Dustin C. Hatch
84313601ef
BIND response policy zones (RPZ) support provides a mechanism for overriding the responses to DNS queries based on a wide range of criteria. In the simplest form, a response policy zone can be used to provide different responses to different clients, or "block" some DNS names. For the Pyrocufflink and related networks, I plan to use an RPZ to implement ad/tracker blocking. The goal will be to generate an RPZ definition from a collection of host lists (e.g. those used by uBlock Origin) periodically. This commit introduces basic support for RPZ configuration in the *named* role. It can be activated by providing a list of "response policy" definitions (e.g. `zone "name"`) in the `named_response_policy` variable, and defining the corresponding zones in `named_zones`.
29 lines
626 B
YAML
29 lines
626 B
YAML
pyrocufflink_red_zones:
|
|
- zone: pyrocufflink.red
|
|
type: master
|
|
default_records:
|
|
- name:
|
|
value: 172.30.0.4
|
|
- name:
|
|
type: AAAA
|
|
value: 2605:6000:3ccc:fb00::4:1
|
|
allow_update:
|
|
- '{ !{ !172.30.0.4; any; }; key dhcp-ddns; }'
|
|
- '{ !{ !localhost; any; }; key local-ddns; }'
|
|
ttl: 30
|
|
- zone: 1.31.172.in-addr.arpa
|
|
type: master
|
|
allow_update:
|
|
- '{ !{ !172.30.0.4; any; }; key dhcp-ddns; }'
|
|
- '{ !{ !localhost; any; }; key local-ddns; }'
|
|
ttl: 30
|
|
|
|
rpz_zones:
|
|
- zone: blackhole.rpz
|
|
type: master
|
|
|
|
named_keys:
|
|
- name: dhcp-ddns
|
|
algorithm: hmac-md5
|
|
secret: +0zVSpY8oFrxl2F1qB8tT2HMgbuD31JurL9w4zilNCg=
|