{"id":2013,"date":"2019-08-18T13:41:12","date_gmt":"2019-08-18T12:41:12","guid":{"rendered":"http:\/\/cdblog.cdstealer.com\/?p=2013"},"modified":"2020-05-16T12:06:31","modified_gmt":"2020-05-16T11:06:31","slug":"dns-firewall","status":"publish","type":"post","link":"https:\/\/cdblog.cdstealer.com\/?p=2013","title":{"rendered":"DNS Firewall"},"content":{"rendered":"

If you're running your own DNS server as described here<\/a>, then you can easily setup your domain zone to block ads, malware, phishing etc etc.
\nI'll describe the process here.<\/p>\n

In named.conf, add the following within the options block:<\/p>\n

response-policy {\n  zone \"sinkhole\";\n};<\/pre>\n
Next is to download the RPZ (Response Policy Zone) file from a reputable source. For the purpose of this, I'll be using EnergizedProtection<\/a>.
\nThis is ~25Mb in size and contains over 900,000 entries.
\nNext I added a new zone to named.conf:<\/p>\n
zone \"sinkhole\" IN {\n        type master;\n        file \"pri\/sinkhole.zone\";\n        notify yes;\n        allow-update { key \"rndc-key\"; };\n};<\/pre>\n
Though I discovered that a few lines were too long. So before restarting named, run a check:<\/p>\n
named-checkconf<\/pre>\n
will check named.conf for errors and<\/p>\n
named-checkzone sinkzone \/var\/bind\/pri\/sinkhole.zone<\/pre>\n
will check the zone file for issues.<\/p>\n
# named-checkzone sinkzone \/var\/bind\/pri\/sinkhole.zone\ndns_master_load: \/var\/bind\/pri\/sinkhole.zone:316077: ran out of space\ndns_master_load: \/var\/bind\/pri\/sinkhole.zone:467504: ran out of space\nzone sinkzone\/IN: loading from master file \/var\/bind\/pri\/test failed: ran out of space\nzone sinkzone\/IN: not loaded due to errors.<\/pre>\n
This means that the given line numbers in the zone file are too long.<\/p>\n
316077 https.outlook.live.com.user0500.deor.error.c8nkichfistk8dphfvkfd9ssli82.is38avdj8h0k381gx0id7hhkg8l.6dls9sz6hv72290ddkuhs.7lxhhjh86k0f2hrivsb1jku718.7lxhhjh86k0f2hrivsb1jku718.h7g6fi9d0fhy6kk6htk4.kwddz0mtsqe28sh3wkj9nhhsd6drh.linestarts.duckdns.org CNAME .\n467504 paypal.com.us.continue.myaccount.account.active.login.us.intl.internationa.transfer.now.login.myaccount.account.active.login.us.intl.internationa.transfer.now.myaccount.account.active.login.us.intl.internationa.transfer.now.newmanhope.duckdns.org CNAME .<\/pre>\n
To workaround this I've written an update script which is run by cron on a weekly basis.<\/p>\n
#!\/usr\/bin\/env bash\n\nzfile='\/var\/bind\/pri\/sinkhole.zone'\nwget -O- https:\/\/block.energized.pro\/ultimate\/formats\/rpz.txt | grep -Pv \"(\\.)?care2\\.com|^#\" > \"${zfile}\"\nerrs=($(\/usr\/sbin\/named-checkzone sinkzone \"${zfile}\" | pcregrep -o1 ':(\\d+):'))\nx=0\nfor a in ${errs[@]}; do\n  a=$[a - ${x} ]\n  sed -i \"${a}d\" \"${zfile}\"\n  x=$[x + 1 ]\ndone\nerrs=($(\/usr\/sbin\/named-checkzone sinkzone \"${zfile}\" | pcregrep -o1 ':(\\d+):'))\nif [ -z ${errs} ]; then\n  echo \"Success, restarting named\"\n  systemctl restart named\nelse\n  echo -e \"We missed some errors in ${zfile}.  On lines:\\n${errs}\"\nfi\n\n<\/pre>\n
That's it...done!<\/p>\n
Changes this:<\/p>\n
\"\"<\/p>\n
into this:<\/p>\n
\"\"<\/p>\n","protected":false},"excerpt":{"rendered":"
If you're running your own DNS server as described here, then you can easily setup your domain zone to block ads, malware, phishing etc etc. I'll describe the process here. In named.conf, add the following within the options block: response-policy { zone \"sinkhole\"; }; Next is to download the RPZ (Response Policy Zone) file from … Continue reading DNS Firewall<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[306,309,310,307,308],"class_list":["post-2013","post","type-post","status-publish","format-standard","hentry","category-gentoo","tag-adblocker","tag-ads","tag-adverts","tag-dns-firewall","tag-rpz"],"_links":{"self":[{"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/posts\/2013","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2013"}],"version-history":[{"count":9,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/posts\/2013\/revisions"}],"predecessor-version":[{"id":2047,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/posts\/2013\/revisions\/2047"}],"wp:attachment":[{"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2013"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2013"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2013"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}