2

I have a DNS server which has two views, one for internal users and one for external (internet for example). I want to config RPZ so that when internal users request (external recursive queries will be denied anyway) a sample website, they will be redirected to another website (a filter page) showing that access is not allowed to this website. But RPZ is not working, query for bad.com returns its real address. I can't find out the problem.

named.conf.options:

options {
    directory "/var/cache/bind";

    // If there is a firewall between you and nameservers you want
    // to talk to, you may need to fix the firewall to allow multiple
    // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

    // If your ISP provided one or more IP addresses for stable 
    // nameservers, you probably want to use them as forwarders.  
    // Uncomment the following block, and insert the addresses replacing 
    // the all-0's placeholder.

 forwarders {
    8.8.8.8;
 };


    response-policy {zone "filter" recursive-only no;};

    //========================================================================
    // If BIND logs error messages about the root key being expired,
    // you will need to update your keys.  See https://www.isc.org/bind-keys
    //========================================================================
#   dnssec-validation auto;

    auth-nxdomain no;    # conform to RFC1035
    listen-on-v6 { any; };
};

named.conf.local:

//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";


acl internal {172.17.116/24; 192.168.20/24; 127/8;};

view "internal" {
    match-clients {internal;};
    recursion yes;
    zone "wsi.org" {
        type master;
        file "/etc/bind/internal.zone";
    };

    zone "filter" {
        type master;
        file "/etc/bind/filter.zone";
    };



    include "/etc/bind/named.conf.default-zones";
};

view "external" {
    match-clients {any;};
    recursion no;
    zone "wsi.org" {
        type master;
        file "/etc/bind/external.zone";
    };

    zone "filter" {
        type master;
        file "/etc/bind/filter2.zone";
    };


    include "/etc/bind/named.conf.default-zones";
};

filter.zone:

TTL 604800
@   IN  SOA wsi.org. root.wsi.org. (
                  3     ; Serial
             604800     ; Refresh
              86400     ; Retry
            2419200     ; Expire
             604800 )   ; Negative Cache TTL

bad.com A   filter.wsi.org
bad.net A   filter.wsi.org

filter2 zone:

TTL 604800
@   IN  SOA wsi.org. root.wsi.org. (
                  3     ; Serial
             604800     ; Refresh
              86400     ; Retry
            2419200     ; Expire
             604800 )   ; Negative Cache TTL

bad.com A   filter.wsi.org
bad.net CNAME   rpz-passthru

nslookup shows the real address of bad.net and bad.com always.

I was experimenting and that's why there are two zones.

3

first correct A record from:

bad.com A   filter.wsi.org 

to:

bad.com A   192.168.1.1

or change like below:

bad.com CNAME   filter.wsi.org

and test config with below:

response-policy {zone "filter";};
0

I found another problem you dont defind ns record in rpz zone file.

@   NS    127.0.0.1.

and use bind tools for troubleshooting your config. For checking config syntax:

named-checkconf

and for checking zone file syntax:

named-checkzone filter /etc/bind/filter.zone

and for checking bind is running without errror:

netstat -lntup | grep 53
  • No It still doesn't work :/ – Mehran Oct 22 '16 at 18:03
  • Did you have any error with named-checkconf and named-checkzone? – Behrad Eslamifar Oct 25 '16 at 9:20
  • I suggest test rpz without view first. – Behrad Eslamifar Oct 25 '16 at 9:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.