4

I am trying to implement this using Unbound and Nsd: https://support.google.com/websearch/answer/186669?hl=en

To force SafeSearch for your network, you’ll need to update your DNS. configuration. Set the DNS entry for www.google.com (and any other Google ccTLD country subdomains your users may use) to be a CNAME for forcesafesearch.google.com.

We will serve SafeSearch Search and Image Search results for requests that we receive on this VIP

I currently have Unbound in pfsense 2.3 set as a recursive DNS resolver. Requests for Google are forwarded to BIND which is listening on localhost. BIND is using an RPZ (Response Policy Zone) and forwards it to google DNS server 8.8.8.8 . A similar approach is found in HK1's answer:

https://superuser.com/questions/826426/how-can-you-satisfy-googles-requirement-to-enforce-safesearch-at-the-network-

All posts on internet use host override except the above example. If the IP address changes, then conf files will need to be changed manually which isn't most reliable option. For performance, footprint ( old hardware ) and possible security enhancements, I would like to switch Bind with Nsd. I would like Unbound to do all resolving. Looking in documentation and forums hasn't led to any fruitful results. With limited testing I always get SERVFAIL when running dig.

I have tried this:

Unbound.conf

...
do-not-query-localhost: no
...
stub-zone:
    name: "google.com."
    stub-addr: 127.0.0.1@5353

stub-zone:
    name: "www.google.com."
    stub-addr: 127.0.0.1@5353

stub-zone:
    name: "google.com.au."
    stub-addr: 127.0.0.1@5353

stub-zone:
    name: "www.google.com.au."
    stub-addr: 127.0.0.1@5353
...

Nsd.conf

...
server:
ip-address: 127.0.0.1
port: 5353
...
zone:
name: "google.com"
zonefile: "google.com.zone"

zone:
name: "google.com.au"
zonefile: "google.com.au.zone"

zone:
name: "www.google.com"
zonefile: "www.google.com.zone"

zone:
name: "www.google.com.au"
zonefile: "www.google.com.au.zone"
...

Zonefile:

$TTL 60
@ IN SOA localhost. root.localhost. (
    2017050500;
    10800;
    3600;
    604800;
    10800 )
    IN      NS      localhost.
;
; Google forced Safe Search zone and data
google.com              CNAME forcesafesearch.google.com.
www.google.com          CNAME forcesafesearch.google.com.
google.com.au           CNAME forcesafesearch.google.com.
www.google.com.au       CNAME forcesafesearch.google.com.
...

Is it possible to use Nsd for Google's safesearch and if so how? ( If a newer version is required, switching to ubuntu server is possible)

Any help would be appreciated.

  • Show your nsd configs etc. – gf_ Aug 21 '17 at 17:39
  • @gf_ relevant configs added – G.Daye Aug 22 '17 at 9:39
  • Could you check whether nsd works fine, using something like dig google.com -p 5353 @127.0.0.1? – gf_ Aug 22 '17 at 9:57
  • Also: Both your configs are redacted, which makes it somewhat hard to debug / spot possible errors. – gf_ Aug 22 '17 at 10:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.