# dnsbl rule

**URL:** <https://community.a10networks.com/t/dnsbl-rule/191>\
**Category:** aFleX\
**Created:** [January 18, 2013, 1:02am UTC](https://community.a10networks.com/t/dnsbl-rule/191 "2013-01-18T01:02:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex002/uploads/a10_community/original/1X/bb9f186d33804d3044a0374e589f49fdf3be1328.png) [@system](https://community.a10networks.com/u/system)\
**Post date:** [January 18, 2013, 1:02am UTC](https://community.a10networks.com/t/dnsbl-rule/191/1 "2013-01-18T01:02:11Z")

</div>

Does anyone know if it is possible to apply an aflex rule to MX VIP and query a dns server and look for a specific response prior to allowing the traffic?

F5 has a function that does this in irules.

Bill

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex002/uploads/a10_community/original/1X/bb9f186d33804d3044a0374e589f49fdf3be1328.png) [@system](https://community.a10networks.com/u/system)\
**Post date:** [January 18, 2013, 1:09am UTC](https://community.a10networks.com/t/dnsbl-rule/191/2 "2013-01-18T01:09:25Z")

</div>

Hi Lewiswil,  
&nbsp;&nbsp;&nbsp;&nbsp;Looking at the doco for aFlex in 2.7.0 I can see both DNS Responce and DNS Request events. You can use DNS::type to check for MX and I think DNS::answer to look for the data you want.

See below

DNS\_REQUEST  
Triggered when the DNS request packet arrives.

Example:

```auto
when DNS\_REQUEST \{
set len [DNS::len]

```

log “dns query pkt len = $len”  
}  
Related Information

Available Commands:  
DNS::len, DNS::header, DNS::question, DNS::rr,  
DNS::answer, DNS::authority, DNS::additional,  
DNS::name, DNS::type, DNS::class, DNS::ttl,  
DNS::rdata, DNS::return, DNS::query

DNS\_RESPONSE

Triggered when the DNS reply packet arrives.

Example:

```auto
when DNS\_RESPONSE \{
set len [DNS::len]

```

log “dns query pkt len = $len”  
}  
Related Information  
Available Commands:  
DNS::len, DNS::header, DNS::question, DNS::rr,  
DNS::answer, DNS::authority, DNS::additional,  
DNS::name, DNS::type, DNS::class, DNS::ttl,  
DNS::rdata, DNS::return, DNS::query

Thanks  
Michael.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex002/uploads/a10_community/original/1X/bb9f186d33804d3044a0374e589f49fdf3be1328.png) [@system](https://community.a10networks.com/u/system)\
**Post date:** [January 18, 2013, 1:19am UTC](https://community.a10networks.com/t/dnsbl-rule/191/3 "2013-01-18T01:19:26Z")

</div>

I guess my question is can something be applied that says. When MX(port 25) packet comes in initiate a call to a dns server and query for the source address. If the response is in the range of 127.0.0.[1-6] block the MX connection. I think I can handle response, but I am having trouble figuring out how to initiate the DNS\_REQUEST when the MX session begins.

Thanks,  
Bill

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex002/uploads/a10_community/original/1X/bb9f186d33804d3044a0374e589f49fdf3be1328.png) [@system](https://community.a10networks.com/u/system)\
**Post date:** [January 18, 2013, 2:29am UTC](https://community.a10networks.com/t/dnsbl-rule/191/4 "2013-01-18T02:29:58Z")

</div>

Hi Bill,  
&nbsp;&nbsp;&nbsp;&nbsp;Since your goal is to block the connection all I think you will need is something like the below.

```auto
when DNS\_RESPONSE \{
   if \{ [DNS::answer end\_with “MX 127.0.0.[1-6]”] \} \{

```

drop  
}  
Thanks  
Michael.