0

how can I resolve some global web sites (google.com, Facebook.com) to local IP address (for example 192.168.0.1). Anyone can help me ?

; Authoritative data for facebook.com zone
;
$TTL 1D
@   IN SOA  epc.facebook.com   root.epc.facebook.com. (
                                       2017031301      ; serial
                                       1D              ; refresh
                                       1H              ; retry
                                       1W              ; expire
                                       3H )            ; minimum

$ORIGIN         facebook.com.
epc                     IN      A       127.0.0.1
facebook.com            IN      A       192.168.0.1

but dig result:

; <<>> DiG 9.10.3-P4-Raspbian <<>> facebook.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21851
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;facebook.com.                  IN      A

;; ANSWER SECTION:
facebook.com.           3441    IN      A       185.60.216.35

;; Query time: 1 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Tue Jan 30 16:51:44 UTC 2018
;; MSG SIZE  rcvd: 57

resolv.conf

# Generated by resolvconf
nameserver 192.168.0.1

named:

   cat named.conf.default-zones
        // prime the server with knowledge of the root servers
        zone "." {
                type hint;
                file "/etc/bind/db.root";
        };

        // be authoritative for the localhost forward and reverse zones, and for
        // broadcast zones as per RFC 1912

        zone "localhost" {
                type master;
                file "/etc/bind/db.local";
        };

        zone "127.in-addr.arpa" {
                type master;
                file "/etc/bind/db.127";
        };

        zone "0.in-addr.arpa" {
                type master;
                file "/etc/bind/db.0";
        };

        zone "255.in-addr.arpa" {
                type master;
                file "/etc/bind/db.255";
        };

        zone "com.farizHost.arpa" {
                type master ;
                file "/etc/bind/fariz.zone.db" ;
        };

And..

root@raspberrypi:/etc/bind# cat named.conf.options
options {
        directory "/var/cache/bind";

        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

        // forwarders {
        //      0.0.0.0;
        // };

        //========================================================================
        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        //========================================================================
        dnssec-validation auto;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
};
  • Is your host only resolving from 192.168.0.1 or do you have additional entries in /etc/resolv.conf? Also, you'll probably want to post your BIND config. – Patrick Jan 30 '18 at 17:01
  • # Generated by resolvconf nameserver 192.168.0.1 – FariZ Jan 30 '18 at 17:05
  • Do you have any forwarders in your named.conf file? – Patrick Jan 30 '18 at 17:06
  • I have updated question – FariZ Jan 30 '18 at 17:10
2

For resolving the domain facebook.com, you need to add a directive:

    zone "facebook.com" {
            type master;
            file "/etc/bind/facebook.db";
    };

Where facebook.db is your file at the beginning of the question.

Your SOA also should be corrected.

IN SOA  epc.facebook.com. root.epc.facebook.com. (

Btw, the SOA domains do not have to be facebook.com.

  • ping result is not ok. (IP is available). ping: facebook.com: Temporary failure in name resolution – FariZ Jan 30 '18 at 17:49
  • ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 33674 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;facebook.com. IN A – FariZ Jan 30 '18 at 17:49
  • cannot resolve facebook.com (other web sites is find which is not defined on zone file) – FariZ Jan 30 '18 at 17:49
  • @FariZ added to the answer. – Rui F Ribeiro Jan 30 '18 at 17:58
0

This is a job for bind RPZ feature, see: https://dnsrpz.info/

Domain Name Service Response Policy Zones (DNS RPZ) is a method that allows a nameserver administrator to overlay custom information on top of the global DNS to provide alternate responses to queries. It is currently implemented in the ISC BIND nameserver (9.8 or later). Another generic name for the DNS RPZ functionality is "DNS firewall".

So as given in the documentation you need:

response-policy { zone "badlist"; };
zone "badlist" {type master; file "master/badlist"; allow-query {none;}; };

in your configuration, and in the "zone" file master/badlist something like:

$TTL 1H
@ SOA LOCALHOST. named-mgr.example.com (1 1h 15m 30d 2h)
  NS LOCALHOST.
www.google.com     A 192.168.0.1
www.facebook.com   A 192.168.0.1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.