dnsnfset

Add IP addresses from DNS replies into nftables' sets.

Two sources of DNS replies are avaliable:

• (LEGACY) UDP packets catched with NFLOG (by kernel firewall) -> Use the branch nflog instead.

• (NEW) Receive via dnstap from your resolver software -> Tested on unbound.

Use dnstap if your resolver support it. It's faster (you got nfset updated BEFORE DNS replies sending out), and it avoid redundant nfset updatings.

Build

Install Rust toolchain (rustup.rs).

Install libclang (bindgen requirements).

Install libnftables (apt install libnftables-dev for example).

Finally,

git clone --recurse-submodules https://github.com/sorz/dnsnfset
cd dnsnfset
cargo build --release
target/release/dnsnfset --help

Usage

1. Configure your resolver to log DNS replies via dnstap. Unbound for example:

# /etc/unbound/unbound.conf
dnstap:
  dnstap-enable: yes
  dnstap-bidirectional: yes
  dnstap-socket-path: /run/dnsnfset/dnstap.sock
  dnstap-log-resolver-response-messages: yes
  dnstap-log-forwarder-response-messages: yes

2. Create set(s) in nftables using nft.
3. Edit rules.conf to specify which domain going to which set.
4. Run dnsnfset --rules <FILE> --socks-path <UNIX-SOCK>.

Future works

1. Handle CNAME properly.
2. Better rule config syntax.