<html><head></head><body><div class="ydp5d8ed4dbyahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir="ltr" data-setdir="false"><div><div dir="ltr" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif;"><div><div dir="ltr">Hi everyone, I hope you all are fine. I am new in the mailing list and looking for an advise. If this mailing-list is not suitable for my below query then please pardon me. </div><div dir="ltr"><br>I am stuck in a situation and looking for a solution. My scenario is like below.</div><div><br></div><div>I want to block some websites for my all users.</div><div><br></div><div>For example:</div><div><b>www.abc.com</b></div><div><b>www.xyz.com</b></div><div>etc</div><div><br></div><div>I did it using Response Policy Zone (RPZ) in BIND.</div><div> </div><div><b>response-policy {zone "rpz";};</b></div><div><b>rrset-order { order cyclic; };</b></div><div><b><br></b></div><div><b>zone "rpz" {</b></div><div><b> type master;</b></div><div><b> allow-query { any; };</b></div><div><b> file "/etc/bind/rpz.db";</b></div><div><b> };</b></div><div><span style="white-space: pre-wrap;"> </span></div><div>In my RPZ zone file I created CNAME entries for above mentioned FQDNs which have been pointed to discard.websites.com</div><div><span style="white-space: pre-wrap;"> </span></div><div><b>www.abc.com IN CNAME discard.websites.com.;</b></div><div dir="ltr"><b>www.xyz.com IN CNAME discard.websites.com.;</b></div><div><br></div><div>And later on, in websites.com zone file (which is another fake zone) I created an A record for discard.websites.com which has been pointed to 192.168.127.127 (a fake IP).</div><div><span style="white-space: pre-wrap;"> </span></div><div><b>discard IN A 192.168.127.127;</b></div><div><br></div><div>In this way all the dns requests from my all users for above mentioned sites are resolved to 192.168.127.127 and the real websites are unreachable.</div><div><br></div><div>(N.B. I am not worry about the situation when users change their DNS IP to any open resolver and can access the websites.)</div><div><br></div><div>Everything was going fine. By this time another requirement came into the picture. Now I need to block the mentioned websites for some specific users (based on source IP).</div><div><br></div><div>So in my RPZ configuration I specified the users source IP block like below.</div><div><br></div><div><b>zone "rpz" {</b></div><div><b> type master;</b></div><div><b> <i><font color="#5b8828">allow-query { 192.168.10.0/24; };</font></i></b></div><div><b> file "/etc/bind/rpz.db";</b></div><div><b> };</b></div><div><br></div><div>At this point the dns queries from the specified block 192.168.10.0/24 are resolved to my fake ip and all other requests from rest of IP blocks are dropped (as expected as per configuration).</div><div><br></div><div>But I want to do like this, the dns queries from 192.168.10.0/24 blocks will be matched with RPZ zone and other requests from rest of IPs will bypass the RPZ configuration and will match my general "allow-query {any;}" statement mentioned in named.conf file.</div><div><br></div><div>Will the logic work as I stated above?? Any comments from the experts will be great for me.</div><div><br></div><div>(N.B. I came to know that, resolving different IP based on different source can be possible in KNOT DNS, but I would be happy to do it in BIND (if possible).</div></div><br></div><div style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif;"><br></div><div class="ydpb36d8b55yiv1093956965ydpaeda4671signature" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif;"><div style="font-family: Helvetica, Arial, sans-serif;"><div><span style="font-size: 9pt;"><br></span></div><div><span style="font-size: 9pt;"><br></span></div><div><span id="ydpb36d8b55yiv1093956965ydpa36d8d91yui_3_13_0_ym1_1_1385807350692_2494" style="font-size: 9pt;">Thanks & Regards,</span></div><div><b><span style="font-size: 9pt; color: rgb(13, 13, 13);"><br></span></b></div><div><b id="ydpb36d8b55yiv1093956965ydpa36d8d91yui_3_13_0_ym1_1_1385807350692_2506"><span id="ydpb36d8b55yiv1093956965ydpa36d8d91yui_3_13_0_ym1_1_1385807350692_2505" style="font-size: 9pt; color: rgb(13, 13, 13);">Md. Abdullah Al Naser</span></b></div><div dir="ltr"><span style="font-size: 12px;">Dhaka, Bangladesh</span></div></div></div></div><br></div></div></body></html>