1

I want to use OpenDNS (parental control) and UnoTelly (geo-restriction circumvention) together.

OpenDNS returns an IP to an error page if the site is blocked. So if I get that error IP, then I want to return that as the result of the lookup. If not, then lookup the name with UnoTelly and return that.

What DNS software can help me do this?

6
  • 1
    the title of this question makes me nervous.
    – mikeserv
    Dec 19, 2015 at 8:17
  • you are not giving much details. I know for sure RPZ in BIND and dnsmasq allow that kind of "mischief". I use RPZ both at enterprise level and at home. If in a raspberry pi-hole is an interesting work to build upon. I actually use VPN services, will investigate unotelly. The mechanisms of DNS do not lend themselves much to resolve yet again a name after it is resolved. They do have official APIs for interception for sure. I do not know wether there is source tinkering involved, but the possibilities of what you are asking are interesting.
    – Rui F Ribeiro
    Dec 19, 2015 at 9:13
  • @RuiFRibeiro: thanks for the info. I'll look into RPZ. I've got a Raspberry Pi, and I'm looking to use it for this purpose. What other details are you interested in? I'd like to avoid tinkering with source. It just feels like someone must have solved this problem before.
    – Graeme P
    Dec 22, 2015 at 7:53
  • One question, why not using the DNS servers from UnoTelly and be done with that?
    – Rui F Ribeiro
    Dec 22, 2015 at 7:56
  • Because UnoTelly allows access to porn and other adult content. I want to block that (I have small children), but I still want to watch Netflix, etc. which are blocked in my home region. OpenDNS blocks porn at the DNS level.
    – Graeme P
    Dec 22, 2015 at 16:24

1 Answer 1

Reset to default
0

You're basically setting up a two-step DNS resolver, which queries two upstream servers and returns a single result based on both answers. I'm not sure whether there's a general way to do this, but it isn't hard to script if you have a good DNS library. Sadly, most programming languages these days don't come with that (at least, not the server side) - but fortunately for us all, Pike does :)

But if you're going to mess with DNS, you're going to have to decide how you handle all types of lookups, not just A/AAAA records. The simplest way would be to pick one of your upstreams as the primary (probably OpenDNS) and use that response unchanged.

The code would look something like this simple DNS logger:

https://github.com/Rosuav/Hogan/blob/master/dnslog.pike

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .