5

I've setup a caching DNS server with bind9 using a root-hints method (like this). It works as desired--but, our IPv6 traffic goes through a gateway outside of my country that makes Netflix think we're visiting from that other country, and this prevents my kids from watching their favorite shows. So I'm thinking that if I can prevent bind9 from returning any AAAA records for netflix.com, the clients will only attempt IPv4 connections to Netflix.

That is: how do I configure bind9 so that AAAA record look-ups for netflix.com are suppressed while valid A record results are returned for netflix.com?

I realize I can create a zone file with just the Netflix domain and have it contain all of the A records for netflix.com that I can find and no AAAA records. But I'm wondering if maybe the above is possible so I don't have to keep the A records in the zone file updated.

5
  • I don't quite see how this is a duplicate. The way I understand the other question, it appears to block a domain entirely, which is not what I want; I want to return valid A records for the domain just not AAAA records.
    – Ole Wolf
    Commented Jan 17, 2017 at 21:05
  • I marked this as a dupe of a RPZ Q&A before I realized that this was question was not for a business environment. If you have any further questions about how to implement such a RPZ rule, you should probably direct it at a more appropriately scoped Stack Exchange site.
    – Andrew B
    Commented Jan 17, 2017 at 21:10
  • 1
    Thanks. But, how do I actually do that? I can readily Google plenty of examples of RPZ snippets but I haven't been able to locate any that capture AAAA records specifically to do something about them while returning the A records as if nothing has happened. What should I write in the RPZ file in order to return a NODATA response for AAAA records only like you suggest?
    – Ole Wolf
    Commented Jan 17, 2017 at 21:22
  • Argh...you're right, NODATA anchors to the entire label and not to a specific record type. That feels like an oversight, I'll probably bug the standard authors if it hasn't been raised on a mailing list already. I apologize for the incorrect flagging, but I would go ahead and ask this question on Superuser due to this being focused on a home setting.
    – Andrew B
    Commented Jan 17, 2017 at 21:28
  • Indeed, not sure you can get BIND to do what you ask for. Something like superuser.com/a/1168140/241293 could do the trick, but that's not with BIND alone. Commented Jan 17, 2017 at 22:00

2 Answers 2

5

I know this is an old post, but (at least) in my version of bind (9.11 on Ubuntu 18.04) I discovered that you can use filter-aaaa-on-v4 combined with match-destinations in a view.

It still requires you to have bind listening on 2 ip adresses, but at least you don't need multiple instances.

192.168.1.1 is the normal dns server. 192.168.1.2 is the ipv6 blocking one.

My config looks kind of like this (partial):

options {
    listen-on port 53 { 192.168.1.1; };
    listen-on port 5353 { 192.168.1.2; };
};

view "ipv4only" {
  match-destinations { 192.168.1.2/24; };
  filter-aaaa-on-v4 yes;
};

view "normal" {
  match-clients { 192.168.1.1/24; };
  zone "netflix.com" {
    type forward;
    forward only;
    forwarders { 192.168.1.2 port 5353; };
  };
};

That makes bind do a forward lookup to itself on another ip, when the domain matches netflix.com.

This eliminates the need for two instances, but sadly requires 2 internal ip adresses. It would be nice if we also could specify a port number in "match-destinations".

1
  • 2
    You could use one of the IPs from the localhost network (127.0.0.0/8) as second IP. I personally use 127.0.0.2 - which works like a charm for bind on linux. This way you don't waste a "regular" IP.
    – DonEstefan
    Commented Apr 22, 2020 at 15:21
2

As is indicated by the comments, bind may not be capable of this. However, I managed to solve the problem with a work-around:

Firstly, I added a second bind service listening on port 5353 with just the following configuration file:

acl mynetworks {
    localhost;
    (And a list with my various LAN networks such as 192.168.0.0/24;)
};

acl everyone {
    any;
};

options {
    directory "/var/cache/bind-ipv4limited";
    filter-aaaa-on-v4 yes;
    #dnssec-validation auto;
    dnssec-enable yes;
    dnssec-validation yes;
    dnssec-lookaside auto;
    dnssec-lookaside . trust-anchor dlv.isc.org.;
    recursion yes;
    allow-query { mynetworks; };

    forwarders {
        8.8.8.8;
        8.8.4.4;
    };
    forward only;

    auth-nxdomain no;    # conform to RFC1035
    listen-on port 5353 { any; };
};

The key here is to use "filter-aaaa-on-v4 yes;" so it ignores AAAA requests.

Then in the original bind service, I added a zone for netflix.com that uses the above DNS service:

zone "netflix.com" {
    type forward;
    forward only;
    forwarders {
        127.0.0.1 port 5353;
    };
};

It's an ugly hack, but it seems to work.

1
  • 1
    Just a note that DLV was killed some years ago, so please don't include that.
    – mcr
    Commented Jan 26, 2021 at 0:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .