nginx-plus-filtering.conf

#
# This config shows an example of filtering DNS requests using the Key/value store available in NGINX Plus
# Push FQDNs into the dns_config key/value zone with a value of "blocked" or "blackhole" to have them scrubbed from DNS
# Alternatively push a CSV list of domains as the value to either "blocked_domains" or "blackhole_domains" to have
# any requests for records within those zones scrubbed.
#

user  nginx;
worker_processes  auto;

load_module modules/ngx_stream_js_module.so;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

# DNS Stream Services
stream {

  # KeyValue store for blocking domains (NGINX Plus only)
  keyval_zone zone=dns_config:64k state=/etc/nginx/zones/dns_config.zone; 
  keyval "blocked_domains" $blocked_domains zone=dns_config;
  keyval "blackhole_domains" $blackhole_domains zone=dns_config;
  keyval $dns_qname $scrub_action zone=dns_config;

  # DNS logging
  log_format  dns   '$remote_addr [$time_local] $protocol "$dns_qname" "$upstream_pool"';
  access_log /var/log/nginx/dns-access.log dns;

  # Import the NJS module
  js_import /etc/nginx/njs.d/dns/dns.js;

  # The $dns_qname variable can be populated by preread calls, and can be used for DNS routing
  js_set $dns_qname dns.get_qname;
  
  # The DNS response packet, if we're blocking the domain, this will be set.
  js_set $dns_response dns.get_response;

  # When doing DNS routing, use $dns_qname to map the questions to the upstream pools.
  map $dns_qname $upstream {
    hostnames;
    *.nginx dnsmasq;
    *.k8s dnsmasq;
    default google;
  }

  # Set upstream to be the pool defined above if dns_response is empty, else pass to the block/blackhole upstream
  map $dns_response $upstream_pool {
    "blocked" blocked;
    "blackhole" blackhole;
    default $upstream;
  }

  # upstream pool for blocked requests (returns nxdomain)
  upstream blocked {
    zone blocked 64k;
    server 127.0.0.1:9953;
  }

  # upstream pool for blacholed requests (returns 0.0.0.0)
  upstream blackhole {
    zone blackhole 64k;
    server 127.0.0.1:9853;
  }

  # upstream pools (google DNS)
  upstream google {
    zone dns 64k;
    server 8.8.8.8:53;
  }

  # upstream pools (another DNS)
  upstream dnsmasq {
    zone dns 64k;
    server 192.168.64.1:5353;
  }

  # DNS(TCP) and DNS over TLS (DoT) Server
  # Upstream can be either DNS(TCP) or DoT. If upstream is DNS, proxy_ssl should be off.
  server {
    listen 53;
    listen 853 ssl;
    ssl_certificate /etc/nginx/ssl/certs/doh.local.pem;
    ssl_certificate_key /etc/nginx/ssl/private/doh.local.pem;
    js_preread dns.preread_dns_request;
    proxy_pass $upstream_pool;
  }

  # DNS(UDP) Server
  # Upstream can only be another DNS(UDP) server.
  server {
    listen 53 udp;
    js_preread dns.preread_dns_request;
    proxy_responses 1;
    proxy_pass $upstream_pool;
  }

  # Server for responding to blocked/blackholed responses
  server {
    listen 127.0.0.1:9953;
    listen 127.0.0.1:9853;
    listen 127.0.0.1:9953 udp;
    listen 127.0.0.1:9853 udp;
    js_preread dns.preread_dns_request;
    return $dns_response;
  }

}