DNSFILTER.CONF(5)

NAME
dnsfilter.conf - DNS filter and rate limiter daemon configuration file

DESCRIPTION
The dnsfilter(8) daemon implements a DNS filter and rate limiter.

SECTIONS
The dnsfilter.conf config file is divided into two main sections.

Global Configuration
    Global settings for dnsfilter(8).

Filter
    Filter rules for incoming and outgoing DNS packets.

The current line can be extended over multiple lines using a backslash (‘\’). Comments can be put anywhere in the file using a hash mark (‘#’), and extend to the end of the current line. Care should be taken when commenting out multi-line text: the comment is effective until the end of the entire block.

Argument names not beginning with a letter, digit, or underscore must be quoted.

Additional configuration files can be included with the include keyword.

GLOBAL CONFIGURATION
    listen on port port-number [divert direction [init | response]] The divert(4) port to listen on.

    The following directions can be used:
    init
        Only divert the initial direction.
    response
        Only divert the response direction.

FILTER
dnsfilter(8) can pass or block DNS packets based on source ip, destination ip, header flags, query TYPE or query CLASS.

For each DNS packet processed by the filter, the filter rules are evaluated in sequential order, from first to last. The last matching pass or block rule decides what action is taken.

The following actions can be used in the filter:

pass
    The DNS packet is passed.

block
    The DNS packet is blocked.

The following parameters can be used in the filter:

log In addition to the action specified, a log message is generated.

quick
    If a packet matches a rule which has the quick option set, this rule is considered the last matching rule, and evaluation of subsequent rules is skipped.

    from <source> to <dest> This rule applies only to packets with the specified source and destination addresses. Additionally any may be used to match any address.

all This is equivalent to "from any to any".

    section ( section spec [, section spec | ...] ) This filters on the number of resource records in the section of the DNS packet. Section spec is of the form section name operator number.

    Where section name can be one of the following keywords:

    query
        query section.

    answer
        answer section

    auth
        authority section

    add additional section

    With the following operators:

        =	(equal)
        !=	(unequal)
        	(less than)
        	(less than or equal)
        	(greater than)
        	(greater than or equal)

    flag ( flag name [, flag name | ...] ) This filters on the presens or absense of flags in the DNS packet header. To match on the absense of a flag prefix the flag name with a !

    The following flag names are possible:

    aa  Authoritative Answer

    ad  Authentic Data

    cd  Checking Disabled

    do  DNSSEC answer OK

    qr  Query

    ra  Recursion Allowed

    rd  Recursion Desired

    tc  Truncated Response

    type operator type name This filters on the query type of the DNS packet.

    Where operator can be one of the following:

        =	(equal)
        !=	(unequal)

    where type name can be one of the following types:

    A

    A6

    AAAA

    AFSDB

    ANY

    APL

    ATMA

    AXFR

    CERT

    CNAME

    DHCID

    DLV

    DNAME

    DNSKEY

    DS

    EID

    GID

    GPOS

    HINFO

    IPSECKEY

    ISDN

    IXFR

    KEY

    KX

    LOC

    MAILA

    MAILB

    MB

    MD

    MF

    MG

    MINFO

    MR

    MX

    NAPTR

    NIMLOC

    NS

    NSAP

    NSAP_PTR

    NSEC

    NSEC3

    NSEC3PARAM

    NULL

    NXT

    OPT

    PTR

    PX

    RP

    RRSIG

    RT

    SIG

    SINK

    SOA

    SPF

    SRV

    SSHFP

    TALINK

    TSIG

    TXT

    UID

    UINFO

    UNSPEC

    WKS

    X25

    class operator class name This filters on the query class of the DNS packet.

    Where operator can be one of the following:

        =	(equal)
        !=	(unequal)

    where class name can be one of the following types:

    ANY Any (wildcard)

    CH  Chaos

    HS  Hesiod

    IN  Internet

    NONE
        No Class

The query rate can be used to filter queries with

    qps <number> overload <table> Above number queries per second the source ip is stored into the pf(4) table.

FILES
/etc/dnsfilter.conf
    dnsfilter(8) configuration file

EXAMPLES
This configuration file will cause dnsfilter to listen on port 700. The dnsfilter will only see query packets, i.e. responses will not be diverted.

The rule set will pass all DNS packets with one query section and no other sections. The source ip is stored in pf(4) table blockeddnshosts if the query rate exceeds 50 queries per second.

All DNS packets with more than one query section will be blocked.

All DNS packets with the do flag set will be blocked.

    listen on port 700 divert direction init
    pass all section (query = 1, answer=0, auth = 0, \
    	additional = 0) \
            qps 50 overload blockeddnshosts
    block log all section (query > 1)
    block log all section ( query = 1, answer=0, auth = 0, \
    	additional = 0 ) \
            flag do

SEE ALSO
dnsfilter(8), pf(4), divert(4)

STANDARDS
P. Mockapetris, November 1987, RFC 1034, Domain Names - Concepts and Facilities.

P. Mockapetris, November 1987, RFC 1035, Domain Names - Implementation and Specification.

R. Arends, R. Austein et al., March 2005, RFC 4034, Resource Records for the DNS Security Extensions.