Skip to content
/ dnsnfset Public

Read IP addresses from dnstap, add them into nftables sets.

License

Notifications You must be signed in to change notification settings

sorz/dnsnfset

Repository files navigation

dnsnfset

Add IP addresses from DNS replies into nftables' sets.

Two sources of DNS replies are avaliable:

  • (LEGACY) UDP packets catched with NFLOG (by kernel firewall) -> Use the branch nflog instead.

  • (NEW) Receive via dnstap from your resolver software -> Tested on unbound.

Use dnstap if your resolver support it. It's faster (you got nfset updated BEFORE DNS replies sending out), and it avoid redundant nfset updatings.

Build

Install Rust toolchain (rustup.rs).

Install libclang (bindgen requirements).

Install libnftables (apt install libnftables-dev for example).

Finally,

git clone --recurse-submodules https://github.com/sorz/dnsnfset
cd dnsnfset
cargo build --release
target/release/dnsnfset --help

Usage

  1. Configure your resolver to log DNS replies via dnstap. Unbound for example:
# /etc/unbound/unbound.conf
dnstap:
  dnstap-enable: yes
  dnstap-bidirectional: yes
  dnstap-socket-path: /run/dnsnfset/dnstap.sock
  dnstap-log-resolver-response-messages: yes
  dnstap-log-forwarder-response-messages: yes
  1. Create set(s) in nftables using nft.
  2. Edit rules.conf to specify which domain going to which set.
  3. Run dnsnfset --rules <FILE> --socks-path <UNIX-SOCK>.

Future works

  1. Handle CNAME properly.
  2. Better rule config syntax.

About

Read IP addresses from dnstap, add them into nftables sets.

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published