0

I'm trying to apply "restrictmoderate.youtube.com" only for kids and let the others access the standard "youtube.com", using Bind9.

# cat named.conf
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
==========================================================================
# cat named.conf.options 
acl goodclients {
    192.168.0.0/16;
    localhost;
    localnets;
};
acl kids   { 192.168.2.0/24; };
acl adults { 192.168.1.0/24; };

options {
    directory "/var/cache/bind";

    recursion yes;
    allow-query { goodclients; };

    // forward traffic to opendns
    forwarders { 208.67.222.222; 208.67.220.220; };

    forward only;

    dnssec-enable yes;
    dnssec-validation yes;

    // Conform to RFC1035
    auth-nxdomain no;

    // Force youtube.com to restrictmoderate.youtube.com
    response-policy { zone "rpz"; };

    listen-on-v6 { none; };
    querylog yes;
};
==========================================================================
# cat named.conf.local 
//include "/etc/bind/zones.rfc1918";
logging{
    channel simple_log {
        file "/var/log/bind/query.log" versions 3;
        severity info;
        print-time yes;
        print-severity yes;
        print-category yes;
    };
    category default{
        simple_log;
    };
};

zone "rpz" IN {
    type master;
    file "/etc/bind/rpdb.zone";
    allow-query { kids; !adults; };
};
==========================================================================
# cat rpdb.zone 
$ORIGIN rpz.
$TTL 1H
@       IN       SOA       localhost. root.localhost. (
                           7
                           1H
                           15m
                           30d
                           2h )
                           NS LOCALHOST.

www.youtube.com           IN CNAME restrictmoderate.youtube.com.
m.youtube.com             IN CNAME restrictmoderate.youtube.com.
youtubei.googleapis.com   IN CNAME restrictmoderate.youtube.com.
youtube.googleapis.com    IN CNAME restrictmoderate.youtube.com.
www.youtube-nocookie.com  IN CNAME restrictmoderate.youtube.com.
google.com                IN CNAME forcesafesearch.google.com.
www.google.com            IN CNAME forcesafesearch.google.com.

I don't understand why the "rpz" zone is applied to everyone (192.168.1.0/24 and 192.168.2.0/24) while I'm expecting it to only apply to the "kids" ACL (192.168.2.0/24):

allow-query { kids; !adults; };

What am I doing wrong? Thanks for your help.

1 Answer 1

1

RPZ zones aren't conventional DNS zones and the allow-query directive doesn't behave as you would typically expect. It's mainly used to limit replication. From https://www.zytrax.com/books/dns/ch7/rpz.html :

RPZ zones may be queried (if a master only by a slave to read its SOA RR, if a slave, never)

. . .

As noted above an RPZ master only needs to be queried by a valid slave in order to read its SOA RR (for zone transfer action). An allow-query statement listing all slave servers or referencing an ACL clause is appropriate. An RPZ slave does not need to be queried at all. An allow-query {none;}; statement is appropriate to implement this.

Your best would probably be to use your ACLs to implement views (no shortage of guides and how-tos for doing that), with the rpz zone only being in the "kids" view. Also, you may want to consider rewriting your ACLs like this to get the same effect of { kids; !adults; } (or adding an "other" ACL to catch everything not in your 2 listed subnets):

acl adults { 192.168.1.0/24; 127.0.0.1; };
acl kids   { !adults; };

Completely up to you though.

Good luck!

2
  • A less sexy solution would be to change your DNS in the DHCP for the "kids" subnet to point to the BIND server and everybody else's subnets to your OpenDNS/ISP servers. Feb 26, 2020 at 6:47
  • Thank you very much for your inputs, that helps! Feb 27, 2020 at 6:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .