1 ; config options 2 server: 3 target-fetch-policy: "0 0 0 0 0" 4 qname-minimisation: no 5 minimal-responses: yes 6 log-servfail: yes 7 access-control: 0.0.0.0/0 allow 8 module-config: "respip iterator" 9 10 rpz: 11 name: "rpz.example.com." 12 rpz-log: yes 13 rpz-log-name: "rpz.example.com" 14 zonefile: 15 TEMPFILE_NAME rpz.example.com 16 TEMPFILE_CONTENTS rpz.example.com 17 $ORIGIN example.com. 18 rpz 3600 IN SOA ns1.rpz.gotham.com. hostmaster.rpz.example.com. ( 19 1379078166 28800 7200 604800 7200 ) 20 3600 IN NS ns1.rpz.example.com. 21 3600 IN NS ns2.rpz.example.com. 22 $ORIGIN rpz.example.com. 23 ; whitelist client 192.0.3.33 24 32.33.3.0.192.rpz-client-ip CNAME rpz-passthru. 25 ; block A 10.20.30.42 26 32.42.30.20.10.rpz-ip CNAME . 27 TEMPFILE_END 28 29 stub-zone: 30 name: "." 31 stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. 32 CONFIG_END 33 34 SCENARIO_BEGIN Test RPZ passthru query, with answer from cache. 35 36 ; K.ROOT-SERVERS.NET. 37 RANGE_BEGIN 0 100 38 ADDRESS 193.0.14.129 39 ENTRY_BEGIN 40 MATCH opcode qtype qname 41 ADJUST copy_id 42 REPLY QR NOERROR 43 SECTION QUESTION 44 . IN NS 45 SECTION ANSWER 46 . IN NS K.ROOT-SERVERS.NET. 47 SECTION ADDITIONAL 48 K.ROOT-SERVERS.NET. IN A 193.0.14.129 49 ENTRY_END 50 51 ENTRY_BEGIN 52 MATCH opcode subdomain 53 ADJUST copy_id copy_query 54 REPLY QR NOERROR 55 SECTION QUESTION 56 tld. IN NS 57 SECTION AUTHORITY 58 tld. IN NS ns.tld. 59 SECTION ADDITIONAL 60 ns.tld. IN A 1.2.3.5 61 ENTRY_END 62 RANGE_END 63 64 ; ns.tld 65 RANGE_BEGIN 0 100 66 ADDRESS 1.2.3.5 67 ENTRY_BEGIN 68 MATCH opcode qtype qname 69 ADJUST copy_id 70 REPLY QR AA NOERROR 71 SECTION QUESTION 72 tld. IN NS 73 SECTION ANSWER 74 tld. IN NS ns.tld 75 SECTION ADDITIONAL 76 ns.tld. IN A 1.2.3.5 77 ENTRY_END 78 79 ENTRY_BEGIN 80 MATCH opcode qtype qname 81 ADJUST copy_id 82 REPLY QR AA NOERROR 83 SECTION QUESTION 84 ns.tld. IN A 85 SECTION ANSWER 86 ns.tld. IN A 1.2.3.5 87 ENTRY_END 88 89 ENTRY_BEGIN 90 MATCH opcode qtype qname 91 ADJUST copy_id 92 REPLY QR AA NOERROR 93 SECTION QUESTION 94 ns.tld. IN AAAA 95 SECTION AUTHORITY 96 tld. 3600 IN SOA ns.tld. host.tld. 20201 3600 1800 604800 3600 97 ENTRY_END 98 99 ENTRY_BEGIN 100 MATCH opcode subdomain 101 ADJUST copy_id copy_query 102 REPLY QR NOERROR 103 SECTION QUESTION 104 example.tld. IN NS 105 SECTION AUTHORITY 106 example.tld. 5 IN NS ns.example.tld. 107 SECTION ADDITIONAL 108 ns.example.tld. 5 IN A 1.2.3.4 109 ENTRY_END 110 RANGE_END 111 112 ; ns.example.tld. 113 RANGE_BEGIN 0 100 114 ADDRESS 1.2.3.4 115 ENTRY_BEGIN 116 MATCH opcode qtype qname 117 ADJUST copy_id 118 REPLY QR NOERROR 119 SECTION QUESTION 120 example.tld. IN NS 121 SECTION ANSWER 122 example.tld. 86400 IN NS ns.example.tld. 123 SECTION ADDITIONAL 124 ns.example.tld. 86400 IN A 1.2.3.4 125 ENTRY_END 126 127 ENTRY_BEGIN 128 MATCH opcode qtype qname 129 ADJUST copy_id 130 REPLY QR AA NOERROR 131 SECTION QUESTION 132 ns.example.tld. IN A 133 SECTION ANSWER 134 ns.example.tld. IN A 1.2.3.4 135 ENTRY_END 136 137 ENTRY_BEGIN 138 MATCH opcode qtype qname 139 ADJUST copy_id 140 REPLY QR AA NOERROR 141 SECTION QUESTION 142 ns.example.tld. IN AAAA 143 SECTION AUTHORITY 144 example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600 145 ENTRY_END 146 147 ENTRY_BEGIN 148 MATCH opcode qtype qname 149 ADJUST copy_id 150 REPLY QR AA NOERROR 151 SECTION QUESTION 152 bad.example.tld. IN A 153 SECTION ANSWER 154 bad.example.tld. IN A 10.20.30.42 155 ENTRY_END 156 157 ENTRY_BEGIN 158 MATCH opcode qtype qname 159 ADJUST copy_id 160 REPLY QR AA NOERROR 161 SECTION QUESTION 162 bad.example.tld. IN AAAA 163 SECTION AUTHORITY 164 example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600 165 ENTRY_END 166 167 RANGE_END 168 169 ; query the record directly, from a blocked client 170 STEP 1 QUERY ADDRESS 192.0.2.1 171 ENTRY_BEGIN 172 REPLY RD NOERROR 173 SECTION QUESTION 174 bad.example.tld. IN A 175 ENTRY_END 176 177 ; RPZ works 178 STEP 2 CHECK_ANSWER 179 ENTRY_BEGIN 180 MATCH all 181 REPLY QR RD RA NXDOMAIN 182 SECTION QUESTION 183 bad.example.tld. IN A 184 SECTION ANSWER 185 ENTRY_END 186 187 ; query the record directly, from the unblocked client 188 STEP 5 QUERY ADDRESS 192.0.3.33 189 ENTRY_BEGIN 190 REPLY RD NOERROR 191 SECTION QUESTION 192 bad.example.tld. IN A 193 ENTRY_END 194 195 STEP 6 CHECK_ANSWER 196 ENTRY_BEGIN 197 MATCH all 198 REPLY QR RD RA NOERROR 199 SECTION QUESTION 200 bad.example.tld. IN A 201 SECTION ANSWER 202 bad.example.tld. IN A 10.20.30.42 203 ENTRY_END 204 205 SCENARIO_END 206
Indexes created Mon Oct 26 00:26:21 UTC 2026