nathanwoodburn/hns_doh_loadbalancer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Update dnsdist config
All checks were successful
Build Docker / Build_Docker (push) Successful in 43s
Details

Browse Source
This commit is contained in:
Nathan Woodburn
2025-08-15 17:21:23 +10:00
parent dadb53ba5e
commit f59e66a8ac
1 changed files with 20 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
dnsdist.conf
View File

@@ -1,9 +1,9 @@
-- --- Dynamic block rules -- --- Dynamic block rules
local dbr = dynBlockRulesGroup() local dbr = dynBlockRulesGroup()
dbr:setQueryRate(20, 10, "Exceeded query rate", 60) dbr:setQueryRate(300, 10, "Exceeded query rate", 60)
dbr:setRCodeRate(DNSRCode.NXDOMAIN, 15, 10, "Exceeded NXD rate", 60) dbr:setRCodeRate(DNSRCode.NXDOMAIN, 50, 10, "Exceeded NXD rate", 60)
dbr:setRCodeRate(DNSRCode.SERVFAIL, 15, 10, "Exceeded ServFail rate", 60) dbr:setRCodeRate(DNSRCode.SERVFAIL, 30, 10, "Exceeded ServFail rate", 60)
dbr:setQTypeRate(DNSQType.ANY, 3, 10, "Exceeded ANY rate", 60) dbr:setQTypeRate(DNSQType.ANY, 1, 10, "Exceeded ANY rate", 60)
dbr:setResponseByteRate(8000, 10, "Exceeded resp BW rate", 60) dbr:setResponseByteRate(8000, 10, "Exceeded resp BW rate", 60)
function maintenance() function maintenance()
@@ -11,15 +11,16 @@ function maintenance()
end end
dbr:apply() dbr:apply()
-- --- Protect against large UDP amplification
-- dnsdist 2.0.0 does not support setMaxUDPSize() or TruncateAction()
-- Use ednsUDPSize in setLocal() to advertise max UDP size
-- Clients requesting larger responses will be truncated automatically
-- --- Basic query mitigations -- --- Basic query mitigations
addAction(QTypeRule(DNSQType.ANY), DropAction()) -- Drop ANY queries addAction(QTypeRule(DNSQType.ANY), RCodeAction(DNSRCode.REFUSED)) -- Block ANY queries
addAction(AndRule{QClassRule(3), QNameRule("version.bind")}, DropAction()) -- Block version.bind addAction(AndRule{QClassRule(3), QNameRule("version.bind")}, DropAction()) -- Block version.bind
-- Max QPS per client
addAction(MaxQPSIPRule(25, 24), DelayAction(50)) -- gentle delay instead of drop
addAction(MaxQPSIPRule(25, 64), DelayAction(100)) -- longer window, slightly longer delay
addAction(AndRule{MaxQPSIPRule(10), TCPRule(false)}, TCAction())
-- Drop queries to local TLDs -- Drop queries to local TLDs
local sldsToDrop = newSuffixMatchNode() local sldsToDrop = newSuffixMatchNode()
sldsToDrop:add("lan.") sldsToDrop:add("lan.")
@@ -40,10 +41,7 @@ if tldsFile then
end end
-- Max QPS per client
addAction(MaxQPSIPRule(15, 24), DropAction())
addAction(MaxQPSIPRule(15, 64), DropAction())
addAction(AndRule{MaxQPSIPRule(5), TCPRule(false)}, TCAction())
-- --- Upstream servers -- --- Upstream servers
-- Public resolvers for official TLDs -- Public resolvers for official TLDs
@@ -66,14 +64,14 @@ localUpstream:setUp()
-- If domain matches official TLDs -> use tldPool -- If domain matches official TLDs -> use tldPool
addAction(SuffixMatchNodeRule(tldNode), PoolAction("tldPool")) addAction(SuffixMatchNodeRule(tldNode), PoolAction("tldPool"))
-- Everything else -> use local upstream -- Cacheing
-- addAction(PassAction()) -- Queries fall through to defaultPool pc = newPacketCache(10000, {maxTTL=86400, minTTL=0, temporaryFailureTTL=60, staleTTL=60, dontAge=false})
-- setServerPolicy("defaultPool") getPool(""):setCache(pc)
getPool("tldPool"):setCache(pc)
-- --- Local listeners -- --- Local listeners
addLocal('0.0.0.0:53', { reusePort = true, ednsUDPSize = 1232 }) -- limit UDP response size addLocal('0.0.0.0:53', { reusePort = true, tcpFastOpenQueueSize=4096 })
addTLSLocal('0.0.0.0', '/etc/letsencrypt/live/hnsdoh.com/fullchain.pem', addTLSLocal('0.0.0.0', '/etc/letsencrypt/live/hnsdoh.com/fullchain.pem',
'/etc/letsencrypt/live/hnsdoh.com/privkey.pem', { reusePort = true }) '/etc/letsencrypt/live/hnsdoh.com/privkey.pem', { reusePort = true })
@@ -100,3 +98,6 @@ end
-- --- Control socket & key -- --- Control socket & key
setKey("csl2icaGACsP3+M9tx55c8+dBxVCnlnqAHEC92P55eo=") setKey("csl2icaGACsP3+M9tx55c8+dBxVCnlnqAHEC92P55eo=")
controlSocket('127.0.0.1:5199') controlSocket('127.0.0.1:5199')
-- webserver("0.0.0.0:5000")
-- setWebserverConfig({password="woodburn", apiKey="woodburn", acl="0.0.0.0/0"})