github/coredns.io
4
0
Fork 0
mirror of https://github.com/coredns/coredns.io.git synced 2024-04-21 12:32:00 +00:00
Code Issues Releases Wiki Activity

auto content sync

Browse Source
This commit is contained in:
coredns-auto-sync[bot]
2021-02-01 14:59:19 +00:00
parent ad3dfdaba1
commit 74ce9e6452
1 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/plugins/acl.md
+13 -3
View File
@@ -4,12 +4,12 @@ description = "*acl* enforces access control policies on source ip and prevents
weight = 1
tags = ["plugin", "acl"]
categories = ["plugin"]
date = "2020-04-28T14:54:51.8775184"
date = "2021-02-01T14:59:19.8771982"
+++
## Description
With `acl` enabled, users are able to block suspicious DNS queries by configuring IP filter rule sets, i.e. allowing authorized queries to recurse or blocking unauthorized queries.
With `acl` enabled, users are able to block or filter suspicious DNS queries by configuring IP filter rule sets, i.e. allowing authorized queries to recurse or blocking unauthorized queries.
This plugin can be used multiple times per Server Block.
@@ -22,7 +22,7 @@ acl [ZONES...] {
```
- **ZONES** zones it should be authoritative for. If empty, the zones from the configuration block are used.
- **ACTION** (*allow* or *block*) defines the way to deal with DNS queries matched by this rule. The default action is *allow*, which means a DNS query not matched by any rules will be allowed to recurse.
- **ACTION** (*allow*, *block*, or *filter*) defines the way to deal with DNS queries matched by this rule. The default action is *allow*, which means a DNS query not matched by any rules will be allowed to recurse. The difference between *block* and *filter* is that block returns status code of *REFUSED* while filter returns an empty set *NOERROR*
- **QTYPE** is the query type to match for the requests to be allowed or blocked. Common resource record types are supported. `*` stands for all record types. The default behavior for an omitted `type QTYPE...` is to match all kinds of DNS queries (same as `type *`).
- **SOURCE** is the source IP address to match for the requests to be allowed or blocked. Typical CIDR notation and single IP address are supported. `*` stands for all possible source IP addresses.
@@ -40,6 +40,16 @@ Block all DNS queries with record type A from 192.168.0.0/16：
}
~~~
Filter all DNS queries with record type A from 192.168.0.0/16：
~~~ corefile
. {
acl {
filter type A net 192.168.0.0/16
}
}
~~~
Block all DNS queries from 192.168.0.0/16 except for 192.168.1.0/24:
~~~ corefile