Re: use RPZ to override AAAA record
Matus UHLAR - fantomas <[email protected]>
| Newsgroups | gmane.network.dns.bind.user |
|---|---|
| Message-ID | <[email protected]> |
On 07.11.25 12:52, Crist Clark wrote: >I still don't understand why an RPZ entry of, > >10.zz.fe80. IN CNAME *. > >Doesn't work for you. I was asking if it's supposed to work and if it can be restrcted only to work for specified domains. I assume it's safe to test this, perhaps outta working time. > Is there a reason you just want to block IPv6 LL >addresses for this domain but allow for others? I found that to be a better solution especially if the client decides to use linklocal addresses in local network. But perhaps global ban of linklocal destinations could be just fine. >With that line in an RPZ, > >$ dig @192.168.64.80 soratool.ch > >; <<>> DiG 9.10.6 <<>> @192.168.64.80 soratool.ch >; (1 server found) >;; global options: +cmd >;; Got answer: >;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56119 >;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 > >;; OPT PSEUDOSECTION: >; EDNS: version: 0, flags:; udp: 1232 >;; QUESTION SECTION: >;soratool.ch. IN A > >;; ANSWER SECTION: >soratool.ch. 300 IN A 160.85.67.44 > >;; Query time: 172 msec >;; SERVER: 192.168.64.80#53(192.168.64.80) >;; WHEN: Fri Nov 07 12:51:20 PST 2025 >;; MSG SIZE rcvd: 56 > >$ dig @192.168.64.80 soratool.ch aaaa > >; <<>> DiG 9.10.6 <<>> @192.168.64.80 soratool.ch aaaa >; (1 server found) >;; global options: +cmd >;; Got answer: >;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65271 >;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 2 > >;; OPT PSEUDOSECTION: >; EDNS: version: 0, flags:; udp: 1232 >;; QUESTION SECTION: >;soratool.ch. IN AAAA > >;; ADDITIONAL SECTION: >rpz. 1 IN SOA localhost. nobody.localhost. 43 86400 43200 604800 10800 > >;; Query time: 174 msec >;; SERVER: 192.168.64.80#53(192.168.64.80) >;; WHEN: Fri Nov 07 12:51:24 PST 2025 >;; MSG SIZE rcvd: 95 -- Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. REALITY.SYS corrupted. Press any key to reboot Universe. -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.