On Sun, Aug 07, 2011 at 03:05:25PM +0100, Sam Crawford wrote:
I'm looking to selectively block certain domains using dnsmasq by
rewriting responses. I realise this can already be done statically
through config files, but I want this to be more dynamic and intend
to operate a set of DNS servers that maintains a list of blocked
I think the thing to change in this grand scheme is what the set of
DNS servers will return. They could be authoritative for blocked
domains, and recursive for everything else. In that case no code
hacks are necessary; you simply use these servers as the upstream
servers for dnsmasq.
It's also possible to use dnsmasq in this upstream role, loading
a list of blocked domains as a hosts file, SIGHUP (IIRC) when it
changes.
domains (as this will be (a) a large list and (b) be used by
numerous clients, so should be centrally managed). So, I'm imaging
the query flow would go a little like this:
1) Client in LAN makes A query for www.example.com to dnsmasq
2) dnsmasq forwards query to ISP-hosted resolver
3) dnsmasq receives response from ISP-hosted resolver
4) dnsmasq sends query to special DNS server to check for blocked status
5) dnsmasq receives response from special 'blocked' DNS server
6) If the query to the 'blocked' DNS server dnsmasq returns success (a
certain magic number), then return the real response to the user
(obtained in step 3), otherwise a spoofed address (e.g. localhost)
What RRtype would this magic number be? My idea also requires no
protocol-level hacks.
Having done domain blocking before, I would recommend that the
address returned for A query point to a special HTTP host with a
page telling the user that the domain was blocked, and why. A simple
static HTML page (which is also used as the 404 page) would suffice.
(Of course, I'd intend to introduce caching in steps 4/5 as
dnsmasq does normally for its forwarding functionality).
A couple of questions arise:
1) Is this a sensible thing to be doing in dnsmasq? Is there
something else that does it natively that I've overlooked?
2) Can anyone point me towards where I should start looking in
the source to incorporate the changes?
Any advice would be greatly appreciated. I've searched the mailing
list archives and couldn't find anything quite like this.
DNS-level domain blocking is not a new idea. http://pgl.yoyo.org/as/
was helpful in my project back in '05 or so. OpenDNS implements a
domain blocking feature as well. http://www.malwaredomains.com/ may
also be of interest.
--
Offlist mail to this address is discarded unless
/dev/rob0 or not-spam is in Subject: header
