Configurations for DNSdist

Configuration examples for DNSdist PowerDNS

Default:

• Default configuration provided by PowerDNS

Administration:

• Enable web admin and console interfaces

Routing DNS traffic:

• Match Qname with regular expression
• Tag your traffic and applied specified rules on it
• Match your traffic from ECS client subnet
• Passing source IP client with ProxyProtocol

Security configuration:

• Ads/Malwares blocking with external CDB database
• DNS tunneling blocking
• Blackhole/spoofing domains with external files
• Blacklist IP addresses with DNS UPDATE control and dynamic blocking duration
• Blacklist IP during XX seconds, the list of IPs is managed with DNS notify and TTL for duration
• List of temporarily blocked domains, the list is managed with DNS notify
• Spoofing DNS responses like TXT, A, AAAA, MX and more...

Logging DNS traffic:

• Remote DNS logging with DNSTAP protocol
• Add extra informations in DNStap field
• Remote DNS logging with Protobuf protocol

Miscs:

• Full configuration with load balancing on public DNS resolvers
• Flush cache for domain with DNS NOTIFY
• Echo capability of ip address from domain name for development
• Resolve hostname from config
• Add uniq ID between queries and replies and send it through EDNS
• Set RequestorID with FFI

Run config from docker

Start

sudo docker run -d -p 8053:53/udp -p 8053:53/tcp -p 8083:8080 --name=dnsdist --volume=$PWD/basic_config.lua:/etc/dnsdist/conf.d/dnsdist.conf:ro powerdns/dnsdist-18:1.8.0

Reload configuration

sudo docker stop dnsdist && sudo docker start dnsdist

Display logs

sudo docker logs dnsdist
dnsdist 1.8.0 comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it according to the terms of the GPL version 2
Added downstream server 1.1.1.1:53
Listening on 0.0.0.0:53
ACL allowing queries from: 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, ::1/128, fc00::/7, fe80::/10
Console ACL allowing connections from: 127.0.0.0/8, ::1/128
Marking downstream 1.1.1.1:53 as 'up'
Polled security status of version 1.8.0 at startup, no known issues reported: OK

Testing DNS resolution

dig @127.0.0.1 -p 8053 +tcp google.com

Testing Web console access

curl -u admin:open http://127.0.0.1:8083