I want to use OpenDNS (parental control) and UnoTelly (geo-restriction circumvention) together.

OpenDNS returns an IP to an error page if the site is blocked. So if I get that error IP, then I want to return that as the result of the lookup. If not, then lookup the name with UnoTelly and return that.

What DNS software can help me do this?

  • 1
    the title of this question makes me nervous. – mikeserv Dec 19 '15 at 8:17
  • you are not giving much details. I know for sure RPZ in BIND and dnsmasq allow that kind of "mischief". I use RPZ both at enterprise level and at home. If in a raspberry pi-hole is an interesting work to build upon. I actually use VPN services, will investigate unotelly. The mechanisms of DNS do not lend themselves much to resolve yet again a name after it is resolved. They do have official APIs for interception for sure. I do not know wether there is source tinkering involved, but the possibilities of what you are asking are interesting. – Rui F Ribeiro Dec 19 '15 at 9:13
  • @RuiFRibeiro: thanks for the info. I'll look into RPZ. I've got a Raspberry Pi, and I'm looking to use it for this purpose. What other details are you interested in? I'd like to avoid tinkering with source. It just feels like someone must have solved this problem before. – Graeme Pyle Dec 22 '15 at 7:53
  • One question, why not using the DNS servers from UnoTelly and be done with that? – Rui F Ribeiro Dec 22 '15 at 7:56
  • Because UnoTelly allows access to porn and other adult content. I want to block that (I have small children), but I still want to watch Netflix, etc. which are blocked in my home region. OpenDNS blocks porn at the DNS level. – Graeme Pyle Dec 22 '15 at 16:24

You're basically setting up a two-step DNS resolver, which queries two upstream servers and returns a single result based on both answers. I'm not sure whether there's a general way to do this, but it isn't hard to script if you have a good DNS library. Sadly, most programming languages these days don't come with that (at least, not the server side) - but fortunately for us all, Pike does :)

But if you're going to mess with DNS, you're going to have to decide how you handle all types of lookups, not just A/AAAA records. The simplest way would be to pick one of your upstreams as the primary (probably OpenDNS) and use that response unchanged.

The code would look something like this simple DNS logger:


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.