Configuration examples for DNSdist PowerDNS
Default:
Administration:
Routing DNS traffic:
- Match Qname with regular expression
- Tag your traffic and applied specified rules on it
- Match your traffic from ECS client subnet
- Passing source IP client with ProxyProtocol
Security configuration:
- Ads/Malwares blocking with external CDB database
- DNS tunneling blocking
- Blackhole/spoofing domains with external files
- Blacklist IP addresses with DNS UPDATE control and dynamic blocking duration
- Blacklist IP during XX seconds, the list of IPs is managed with DNS notify and TTL for duration
- List of temporarily blocked domains, the list is managed with DNS notify
- Spoofing DNS responses like TXT, A, AAAA, MX and more...
Logging DNS traffic:
- Remote DNS logging with DNSTAP protocol
- Add extra informations in DNStap field
- Remote DNS logging with Protobuf protocol
Miscs:
- Full configuration with load balancing on public DNS resolvers
- Flush cache for domain with DNS NOTIFY
- Echo capability of ip address from domain name for development
- Resolve hostname from config
Start
sudo docker run -d -p 8053:53/udp -p 8053:53/tcp -p 8083:8080 --name=dnsdist --volume=$PWD/basic_config.lua:/etc/dnsdist/conf.d/dnsdist.conf:ro powerdns/dnsdist-18:1.8.0Reload configuration
sudo docker stop dnsdist && sudo docker start dnsdistDisplay logs
sudo docker logs dnsdist
dnsdist 1.8.0 comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it according to the terms of the GPL version 2
Added downstream server 1.1.1.1:53
Listening on 0.0.0.0:53
ACL allowing queries from: 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, ::1/128, fc00::/7, fe80::/10
Console ACL allowing connections from: 127.0.0.0/8, ::1/128
Marking downstream 1.1.1.1:53 as 'up'
Polled security status of version 1.8.0 at startup, no known issues reported: OKTesting DNS resolution
dig @127.0.0.1 -p 8053 +tcp google.comTesting Web console access
curl -u admin:open http://127.0.0.1:8083