upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-01-14 18:52:55 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- rpz triggers, man page explanation of rpz zone contents.

Browse source
This commit is contained in:
W.C.A. Wijngaards 2021-03-12 10:21:48 +01:00
parent 4f892a37bd
commit da0bbcec48
1 changed files with 38 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
doc/unbound.conf.5.in
View file

@ -2389,6 +2389,44 @@ QNAME, Response IP Address, nsdname, nsip and clientip triggers are supported.
Supported actions are: NXDOMAIN, NODATA, PASSTHRU, DROP, Local Data, tcp\-only
and drop. RPZ QNAME triggers are applied after \fBlocal\-zones\fR and
before \fBauth\-zones\fR.
.P
The rpz zone is formatted with a SOA start record as usual. The items in
the zone are entries, that specify what to act on (the trigger) and what to
do (the action). The trigger to act on is recorded in the name, the action
to do is recorded as the resource record. The names all end in the zone
name, so you could type them without a trailing dot in the zonefile.
.P
An example RPZ record, that answers example.com with NXDOMAIN
.nf
example.com CNAME .
.fi
.P
The triggers are encoded in the name on the left
.nf
name query name
netblock.rpz-client-ip. client IP address
netblock.rpz-ip. response IP address in the answer
name.rpz-nsdname. nameserver name
netblock.rpz-nsip. nameserver IP address
.fi
The netblock is written as <netblocklen>.<ip address in reverse>.
For IPv6 use 'zz' for '::'. Specify indiviual addresses with scope length
of 32 or 128. For example, 24.10.100.51.198.rpz-ip is 198.51.100.10/24 and
32.10.zz.db8.2001.rpz-ip is 2001:db8:0:0:0:0:0:10/32.
.P
The actions are specified with the record on the right
.nf
CNAME . nxdomain reply
CNAME *. nodata reply
CNAME rpz-passthru. do nothing, allow to continue
CNAME rpz-drop. the query is dropped
CNAME rpz-tcp-only. answer over TCP
A 192.0.2.1 answer with this IP address
.fi
Other records like AAAA, TXT and other CNAMEs (not rpz-..) can also be used to
answer queries with that content.
.P
The RPZ zones can be configured in the config file with these settings in the \fBrpz:\fR block.
.TP
.B name: \fI<zone name>
Name of the authority zone.