<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>Restrict DNS reply to specific clients</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P DIR=LTR><SPAN LANG="nl-be"><FONT FACE="Calibri">Hi all,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="nl-be"></SPAN></P>
<P DIR=LTR><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">I have a DNS server that is</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">master for some public domains. We also have clients that use the DNS server as their lookup server.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">For security issues we use dnsmasq to redirect some sites to a webpage that indicates that the site is not accepted.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">I have setted the dnsmasq before the named service. But this means that all internet clients can use our DNS server to query requests which is not good.</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">I want to restrict the possible query requests to only our client networks.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">I had a filter setted up under the named service</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> </SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">allow-recursion { localhost;</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">x.x.x.x</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">/2</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">4</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">;</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">y</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">.</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">y</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">.</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">y.y</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">/24; };</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">D</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">nsmasq use</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">s</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> the port 53 and if no match is made on the blocked list he forwards it to himself on port 5353 where the named.service runs</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">. The named service sees the request as coming from localhost and does the recursion.</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">I am sorry if this is unclear, I am not so familiar with dns or dnsmasq. If its not clear please says</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">s</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">o and I will try to be more detaile</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">d</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">Version of dnsmasq: dnsmasq-2.65-6.fc17.x86_64</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">Thanks all in advance</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Best Regards,</FONT></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="nl-be"><B></B></SPAN><SPAN LANG="nl-be"><B></B></SPAN><B><SPAN LANG="en-us"></SPAN></B><B><SPAN LANG="en-us"><FONT COLOR="#000080" SIZE=2 FACE="Verdana">Guy Wijnants</FONT></SPAN></B><SPAN LANG="nl-be"></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"><BR>
</SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="nl-be"></SPAN><SPAN LANG="en-us"></SPAN></P>
</BODY>
</HTML>