Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I use dnsmasq as a whitelist on my network. My dnsmasq.conf file looks like this:

bogus-priv
domain-needed
no-resolv

server=/stackexchange.com/8.8.8.8
#etc...

I would like to be able to block a subdomain, for example:

server=/meta.stackexchange.com/0.0.0.0

I also tried:

address=/meta.stackexchange.com/0.0.0.0

And for both I tried substituting 127.0.0.1 for 0.0.0.0.

Unfortunately this doesn't seem to work. How can I block a specific subdomain while allowing the rest of the domain in the config file?

share|improve this question

migrated from serverfault.com May 23 at 1:30

This question came from our site for professional system and network administrators.

2 Answers 2

Please do not hijack the DNS. This interferes with the low-level architecture of the Internet. There are nearly no ethical applications of DNS hijacking that would not be better served by a firewall appliance or program.

If you want to prevent the resolution of a zone to an address, you can easily edit the client hosts file.

While dnsmasq is capable of serving the type of 'spoofed' DNS results you describe, the dnsmasq server can easily be circumvented by an end-user or malicious attacker accessing the client host. This type of DNS hijacking is therefore nearly incapable of providing any benefit to security.

Again, a properly configured firewall appliance would likely serve you much better if the goal is blocking clients from accessing malicious or untrusted remote hosts unintentionally. A trendy solution is OpenWRT on a Rasperry Pi, as described in this article.

share|improve this answer
    
+1 for L7 filtering with netfilter –  Marcel May 28 at 16:51
    
Editing clients' host files in this case is not possible/practical. How could the server be circumvented by an end user or a malicious attacker? As for using iptables/netfilter, I've looked into that in the past and the problem has always been using domain names in firewall rules - which are resolved at start up and subject to change. I do have an iptables rule to drop DNS queries though. –  Koveras May 29 at 23:27
    
It is unfortunate that this received the bounty automatically, even though it didn't answer the question. –  Koveras Jun 2 at 19:05

You can block a website with host record:

host-record=meta.stackexchange.com,127.0.0.1

or a cname:

cname=meta.stackexchange.com,blackhole.com

But really both of these are pretty ineffective ways to block a website. I could go to my /etc/hosts file and fix the issue.

share|improve this answer
    
"I could go to my /etc/hosts file and fix the issue." You'd have to get the IP address first, which you wouldn't be able to on this network. –  Koveras May 29 at 15:14
    
not quite... nslookup meta.stackexchange.com 8.8.8.8 will bypass your default DNS server. –  exabrial May 29 at 18:49
    
Ah, I forgot to mention. I have an iptables rule to drop DNS queries. –  Koveras May 29 at 23:26
    
Neither of these work. cname because There are significant limitations on the target; it must be a DNS name which is known to dnsmasq from /etc/hosts (or additional hosts files), from DHCP, from --interface-name or from another --cname. If the target does not satisfy this criteria, the whole cname is ignored. (man) I'm not sure why host-record doesn't work. –  Koveras May 30 at 1:16
    
host-record works for me... strange. –  exabrial May 30 at 14:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.