Per client, per domain complex behavior #1208
Comments
|
You could accomplish this with both tags and views as per https://unbound.docs.nlnetlabs.nl/en/latest/topics/filtering/tags-views.html. If something is not clear on that page we can always improve the text. I believe the instructions you gave for domain2 are confusing but the examples below still work one way or another. Tag example:View example:You can try the above examples locally with something like:
Per IP prefix you can only apply a single view (the first one configured IIRC), but multiple tags.
Generally no. access-control-tag-action describes when the tag order matters.
Yes , however it can be way more involved than the above, way less performant, but maybe more dynamic if the script talks to external sources. If you are interested in something like that I can see if I could give some quick pointers. |
|
@gthess Thank you very much for your response, it's exactly what I was looking for. To do what I wanted, which was to block a set of domains for a list of specific clients and at the same time allow specific domains for a list of specific clients - and those two lists of clients overlap - the config gets big and complicated fast, especially if adding additional domains with those type so requirements. I actually wrote a python script to generate the config using the views method. The documentation is relatively clear but it's lacking meaningful examples like the ones you provided. I would be very interested in hearing more about per client/per query/domain handling using a python module. Ideally I would like to be able to "hook" by client IP/query criteria. For clients this would mean any client that does not have per-client criteria would be handled normally (and therefore not impact performance). For clients that are hooked it would be possible to send any response of any kind, up to and including arbitrary bytes replied to on the same socket. I can think of quite a few interesting doors that would open up. I am guessing this is mostly possible, I just was not able to figure out the API in the amount of time I had available a few years back when I looked into it. On that note, the pfsense unbound package does not currently allow activation of more than one python module at a time, which I could pretty easily work around, but it would be great if at some point that changes and they could be stacked in priority order. I have not yet experimented with opnsense or other firewalls. Thanks again! |
I am unable to configure per client per domain response handling following any method after reading the documentation thoroughly and extensively searching the issues and web examples for more complete explanations than provided in the documentation. Behavior would preferably be by record type, but just A/AAAA I could work with, not concerned about performance. This is the required behavior for my application:
Are tags, views, both or neither necessary for this behavior? How many views would be required? How are views prioritized after largest subnet they are tagged with? Can you apply multiple views (in priority order) to a specific client IP to control responses for specific domain(s)?
More generally - does order matter in the config - if so which items and how? Does indentation change the scoping? Is the English language documentation missing information on these features? Is it possible to use a python script that dictates the exact behavior required by hooking on specific client IP's to allow arbitrary logic?
I found very little documentation or examples on python response handling implementation except for pfblockerng which does not do per host DNS actions.
I appreciate any help you can provide.
System:
unbound -Voutput:The text was updated successfully, but these errors were encountered: