5 ms·

Could someone post the same approach, but using bind (DNS), handling all those entries in one zone? Is it possible?

mhurron 14y ago
I run BIND at home for my network and take advantage of that to do the following: https://isc.sans.edu/diary/Easy+DNS+BIND+Sinkhole+Setup/7930 https://isc.sans.edu/diary/Easy+DNS+BIND+Sinkhole+Setup/7930 I also have a webserver that any black holed domain is sent to so that there is no waiting for a web request to time out. The first time I put it in place I didn't have the webserver so the performance when hitting one of these was horrible. I also use it for any ad server or analytic site I want to permanently block. This way I don't have to distribute and update a hosts file to every machine in the house and I control where the offending sites redirect too.
- davidcollantes 14y ago
  Exactly this. I have been creating master zones on my named.conf and pointing them to a blocked.txt file. My method is more cumbersome, the one you linked is very streamlined. Excellent, and thanks!
  - mhurron 14y ago
    I also made a little thing for adding additional zones to the list when I was playing a little with Bootstrap. I wrote a little page to add, enable and disable (if I blocked something important) entries. Then a cron job to pull the enabled domains, build the conf file and reload BIND.
jackalope 14y ago
Yes, it's actually pretty easy. First, create a zone file that all of the domains will share. I put mine in /var/named/master/dummy: $TTL 1d @ IN SOA ns1.localdomain. hostmaster.ns1.localdomain. ( 2012100601 ; serial 8h ; refresh 2h ; retry 7d ; expire 1h ; default_ttl ) ; ; Name servers ; @ IN NS ns1.localdomain. @ IN NS ns2.localdomain. ; ; Host addresses ; Leave commented to return NXDOMAIN ; Uncomment to resolve to IP address ;@ IN A 127.0.0.1 I prefer not resolve these hosts at all (NXDOMAIN), because it seems to be faster and I don't want client machines to probe themselves, but you can uncomment the A record and use whatever IP address you want (e.g. for sinkhole monitoring). Remember to increment the serial number with every edit (which will be rare or never, once you've set it to your liking). Next, create a simple file with each domain you want to block on one line. I put mine in /var/named/dummy: ads.example.com tracker.example.com example.org Now create a conf file in the format bind expects, pointing every domain to the zone file (for convenience, put this in /var/named/Makefile in a 'dummy' target): sed 's/.*/zone "&" { type master; file "master\/dummy"; };/' < dummy > dummy.conf Which will result in /var/named/dummy.conf containing: zone "ads.example.com" { type master; file "master/dummy"; }; zone "tracker.example.com" { type master; file "master/dummy"; }; zone "example.org" { type master; file "master/dummy"; }; Finally, add to your named.conf: include "/var/named/dummy.conf"; Restart bind and you're now authoritative for those zones on your network!
- csense 14y ago
  Bind is really confusing. One of these days I'm gonna roll my own DNS server in Python with a sane configuration syntax.

I run BIND at home for my network and take advantage of that to do the following: https://isc.sans.edu/diary/Easy+DNS+BIND+Sinkhole+Setup/7930 https://isc.sans.edu/diary/Easy+DNS+BIND+Sinkhole+Setup/7930 I also have a webserver that any black holed domain is sent to so that there is no waiting for a web request to time out. The first time I put it in place I didn't have the webserver so the performance when hitting one of these was horrible. I also use it for any ad server or analytic site I want to permanently block. This way I don't have to distribute and update a hosts file to every machine in the house and I control where the offending sites redirect too.

davidcollantes 14y ago
Exactly this. I have been creating master zones on my named.conf and pointing them to a blocked.txt file. My method is more cumbersome, the one you linked is very streamlined. Excellent, and thanks!
- mhurron 14y ago
  I also made a little thing for adding additional zones to the list when I was playing a little with Bootstrap. I wrote a little page to add, enable and disable (if I blocked something important) entries. Then a cron job to pull the enabled domains, build the conf file and reload BIND.

jackalope 14y ago

Yes, it's actually pretty easy. First, create a zone file that all of the domains will share. I put mine in /var/named/master/dummy: $TTL 1d @ IN SOA ns1.localdomain. hostmaster.ns1.localdomain. ( 2012100601 ; serial 8h ; refresh 2h ; retry 7d ; expire 1h ; default_ttl ) ; ; Name servers ; @ IN NS ns1.localdomain. @ IN NS ns2.localdomain. ; ; Host addresses ; Leave commented to return NXDOMAIN ; Uncomment to resolve to IP address ;@ IN A 127.0.0.1 I prefer not resolve these hosts at all (NXDOMAIN), because it seems to be faster and I don't want client machines to probe themselves, but you can uncomment the A record and use whatever IP address you want (e.g. for sinkhole monitoring). Remember to increment the serial number with every edit (which will be rare or never, once you've set it to your liking). Next, create a simple file with each domain you want to block on one line. I put mine in /var/named/dummy: ads.example.com tracker.example.com example.org Now create a conf file in the format bind expects, pointing every domain to the zone file (for convenience, put this in /var/named/Makefile in a 'dummy' target): sed 's/.*/zone "&" { type master; file "master\/dummy"; };/' < dummy > dummy.conf Which will result in /var/named/dummy.conf containing: zone "ads.example.com" { type master; file "master/dummy"; }; zone "tracker.example.com" { type master; file "master/dummy"; }; zone "example.org" { type master; file "master/dummy"; }; Finally, add to your named.conf: include "/var/named/dummy.conf"; Restart bind and you're now authoritative for those zones on your network!

csense 14y ago
Bind is really confusing. One of these days I'm gonna roll my own DNS server in Python with a sane configuration syntax.