1 ; config options 2 server: 3 target-fetch-policy: "0 0 0 0 0" 4 qname-minimisation: no 5 minimal-responses: yes 6 log-servfail: yes 7 access-control: 0.0.0.0/0 allow 8 ; module-config: "dns64 respip iterator" 9 ; or 10 module-config: "respip dns64 iterator" 11 dns64-prefix: 64:ff9b::/96 12 ; possibly as well: 13 ; response-ip: 192.0.2.66/32 always_nxdomain 14 15 rpz: 16 name: "rpz.example.com." 17 rpz-log: yes 18 rpz-log-name: "rpz.example.com" 19 zonefile: 20 TEMPFILE_NAME rpz.example.com 21 TEMPFILE_CONTENTS rpz.example.com 22 $ORIGIN example.com. 23 rpz 3600 IN SOA ns1.rpz.gotham.com. hostmaster.rpz.example.com. ( 24 1379078166 28800 7200 604800 7200 ) 25 3600 IN NS ns1.rpz.example.com. 26 3600 IN NS ns2.rpz.example.com. 27 $ORIGIN rpz.example.com. 28 ; whitelist client 192.0.3.33 29 32.33.3.0.192.rpz-client-ip CNAME rpz-passthru. 30 ; block A 10.20.30.42 31 32.42.30.20.10.rpz-ip CNAME . 32 TEMPFILE_END 33 34 stub-zone: 35 name: "." 36 stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. 37 CONFIG_END 38 39 SCENARIO_BEGIN Test RPZ passthru query with DNS64 enabled. 40 41 ; K.ROOT-SERVERS.NET. 42 RANGE_BEGIN 0 100 43 ADDRESS 193.0.14.129 44 ENTRY_BEGIN 45 MATCH opcode qtype qname 46 ADJUST copy_id 47 REPLY QR NOERROR 48 SECTION QUESTION 49 . IN NS 50 SECTION ANSWER 51 . IN NS K.ROOT-SERVERS.NET. 52 SECTION ADDITIONAL 53 K.ROOT-SERVERS.NET. IN A 193.0.14.129 54 ENTRY_END 55 56 ENTRY_BEGIN 57 MATCH opcode subdomain 58 ADJUST copy_id copy_query 59 REPLY QR NOERROR 60 SECTION QUESTION 61 tld. IN NS 62 SECTION AUTHORITY 63 tld. IN NS ns.tld. 64 SECTION ADDITIONAL 65 ns.tld. IN A 1.2.3.5 66 ENTRY_END 67 RANGE_END 68 69 ; ns.tld 70 RANGE_BEGIN 0 100 71 ADDRESS 1.2.3.5 72 ENTRY_BEGIN 73 MATCH opcode qtype qname 74 ADJUST copy_id 75 REPLY QR AA NOERROR 76 SECTION QUESTION 77 tld. IN NS 78 SECTION ANSWER 79 tld. IN NS ns.tld 80 SECTION ADDITIONAL 81 ns.tld. IN A 1.2.3.5 82 ENTRY_END 83 84 ENTRY_BEGIN 85 MATCH opcode qtype qname 86 ADJUST copy_id 87 REPLY QR AA NOERROR 88 SECTION QUESTION 89 ns.tld. IN A 90 SECTION ANSWER 91 ns.tld. IN A 1.2.3.5 92 ENTRY_END 93 94 ENTRY_BEGIN 95 MATCH opcode qtype qname 96 ADJUST copy_id 97 REPLY QR AA NOERROR 98 SECTION QUESTION 99 ns.tld. IN AAAA 100 SECTION AUTHORITY 101 tld. 3600 IN SOA ns.tld. host.tld. 20201 3600 1800 604800 3600 102 ENTRY_END 103 104 ENTRY_BEGIN 105 MATCH opcode subdomain 106 ADJUST copy_id copy_query 107 REPLY QR NOERROR 108 SECTION QUESTION 109 example.tld. IN NS 110 SECTION AUTHORITY 111 example.tld. 5 IN NS ns.example.tld. 112 SECTION ADDITIONAL 113 ns.example.tld. 5 IN A 1.2.3.4 114 ENTRY_END 115 RANGE_END 116 117 ; ns.example.tld. 118 RANGE_BEGIN 0 100 119 ADDRESS 1.2.3.4 120 ENTRY_BEGIN 121 MATCH opcode qtype qname 122 ADJUST copy_id 123 REPLY QR NOERROR 124 SECTION QUESTION 125 example.tld. IN NS 126 SECTION ANSWER 127 example.tld. 86400 IN NS ns.example.tld. 128 SECTION ADDITIONAL 129 ns.example.tld. 86400 IN A 1.2.3.4 130 ENTRY_END 131 132 ENTRY_BEGIN 133 MATCH opcode qtype qname 134 ADJUST copy_id 135 REPLY QR AA NOERROR 136 SECTION QUESTION 137 ns.example.tld. IN A 138 SECTION ANSWER 139 ns.example.tld. IN A 1.2.3.4 140 ENTRY_END 141 142 ENTRY_BEGIN 143 MATCH opcode qtype qname 144 ADJUST copy_id 145 REPLY QR AA NOERROR 146 SECTION QUESTION 147 ns.example.tld. IN AAAA 148 SECTION AUTHORITY 149 example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600 150 ENTRY_END 151 152 ENTRY_BEGIN 153 MATCH opcode qtype qname 154 ADJUST copy_id 155 REPLY QR AA NOERROR 156 SECTION QUESTION 157 bad.example.tld. IN A 158 SECTION ANSWER 159 bad.example.tld. IN A 10.20.30.42 160 ENTRY_END 161 162 ENTRY_BEGIN 163 MATCH opcode qtype qname 164 ADJUST copy_id 165 REPLY QR AA NOERROR 166 SECTION QUESTION 167 bad.example.tld. IN AAAA 168 SECTION AUTHORITY 169 example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600 170 ENTRY_END 171 172 RANGE_END 173 174 ; query the record directly, from the unblocked client 175 STEP 5 QUERY ADDRESS 192.0.3.33 176 ENTRY_BEGIN 177 REPLY RD NOERROR 178 SECTION QUESTION 179 bad.example.tld. IN A 180 ENTRY_END 181 182 STEP 6 CHECK_ANSWER 183 ENTRY_BEGIN 184 MATCH all 185 REPLY QR RD RA NOERROR 186 SECTION QUESTION 187 bad.example.tld. IN A 188 SECTION ANSWER 189 bad.example.tld. IN A 10.20.30.42 190 ENTRY_END 191 192 ; query the record with dns64, from the unblocked client. 193 STEP 10 QUERY ADDRESS 192.0.3.33 194 ENTRY_BEGIN 195 REPLY RD NOERROR 196 SECTION QUESTION 197 bad.example.tld. IN AAAA 198 ENTRY_END 199 200 STEP 11 CHECK_ANSWER 201 ENTRY_BEGIN 202 MATCH all 203 REPLY QR RD RA NOERROR 204 SECTION QUESTION 205 bad.example.tld. IN AAAA 206 SECTION ANSWER 207 bad.example.tld. 3600 IN AAAA 64:ff9b::a14:1e2a 208 ENTRY_END 209 210 ; query the record with dns64, from a blocked client. 211 STEP 15 QUERY ADDRESS 192.0.2.1 212 ENTRY_BEGIN 213 REPLY RD NOERROR 214 SECTION QUESTION 215 bad.example.tld. IN AAAA 216 ENTRY_END 217 218 STEP 16 CHECK_ANSWER 219 ENTRY_BEGIN 220 MATCH all 221 REPLY QR RD RA NOERROR 222 SECTION QUESTION 223 bad.example.tld. IN AAAA 224 SECTION ANSWER 225 SECTION AUTHORITY 226 example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600 227 ENTRY_END 228 229 ; query the record directly, from a blocked client 230 STEP 21 QUERY ADDRESS 192.0.2.1 231 ENTRY_BEGIN 232 REPLY RD NOERROR 233 SECTION QUESTION 234 bad.example.tld. IN A 235 ENTRY_END 236 237 ; RPZ works 238 STEP 22 CHECK_ANSWER 239 ENTRY_BEGIN 240 MATCH all 241 REPLY QR RD RA NXDOMAIN 242 SECTION QUESTION 243 bad.example.tld. IN A 244 SECTION ANSWER 245 ENTRY_END 246 247 SCENARIO_END 248
Indexes created Mon Oct 26 00:26:21 UTC 2026