Drop certain DNS queries (ANY and RD)

mischa · October 2013

When you don't want to allow certain DNS queries to be send to the DNS server.

when RULE_INIT {
  set ::DEBUG 0
}

when DNS_REQUEST {
  if { $::DEBUG == 1 } { log "Question: name: [DNS::question name] - type: [DNS::question type] - Query ID: [DNS::header id] - RD: [DNS::header rd]" }
  if { [DNS::question type] eq "ANY" } {
    if { $::DEBUG == 1 } { log "Drop ANY query from [IP::client_addr]" }
    drop
  } elseif { [DNS::header rd] } { 
    drop
    if { $::DEBUG == 1 } { log "Drop RD query from [IP::client_addr]" }
  }
}

mischa · October 2013

File attached.

Drop certain DNS queries (ANY and RD)

Comments