Hmmm - Ok let me try doing that. Thanks for letting me know
On Fri, Nov 15, 2024 at 3:43 PM Lee <ler...@gmail.com> wrote:
>
> On Thu, Nov 14, 2024 at 1:48 AM Blason R wrote:
> >
> > Hello Team,
> >
> > I am encountering an unusual problem. I am using BIND version BIND
> > 9.18.19-1+ubuntu22.04.1+isc+1-Ubuntu and have configured BIND RPZ. My
> > objective is to block access to app.hubspot.com, for which I have
> > established a zone.
> >
> > response-policy {
> > zone "custom.block";
> > ...
> > ..
> > }
>
> Try adding
>
> break-dnssec yes
> recursive-only no
> qname-wait-recurse no;
>
> after the closing }
>
> > zone "custom.block" { type master; file
> > "/var/lib/bind/zones/custom.block.db";};
> >
> > And here is zone file
> >
> > $TTL 180
> > @ IN SOA ns1.custom.block. ns1.custom.block.
> > ( 2006060301 21600 3600 604800 3600 )
>
> I get an error - the left paren needs to be on the SOA line
>
> > IN NS ns1.custom.block.
>
> try it with localhost.
>
> > ns1.custom.block. IN A 172.1.xx.xx
> > wg.custom.block. IN A 172.1.xx.xx
> > app.hubspot.com CNAME wg.custom.block.
>
> and remove the trailing periods.
>
> $ cat db.custom.block
> $TTL 180
> @ IN SOA localhost. ns1.custom.block. (
> 2006060301 21600 3600 604800 3600 )
> IN NS localhost.
>
> wg.custom.block IN A 172.19.2.3
> app.hubspot.com CNAME wg.custom.block
>
>
> >
> > and then I have forwarders set forwarders {
> > 1.1.1.1;9.9.9.9;
> > };
> >
> > and unfortunately this setup is not working for only this entry I
> > tried capturing a packet and I see the packets are directly being
> > forwarded to forwarders not sure why?
>
> Maybe because you're missing "qname-wait-recurse no" on the
> response-policy stanza?
> Or maybe because something else.. I do too much cargo-culting with bind :(
>
> In any case:
>
> $ dig app.hubspot.com
>
> ; <<>> DiG 9.16.50-Debian <<>> app.hubspot.com
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59928
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2
>
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags:; udp: 1432
> ; COOKIE: 06ad2d9bbff3719e0100000067371d9e67f1acf5b18ff038 (good)
> ;; QUESTION SECTION:
> ;app.hubspot.com. IN A
>
> ;; ANSWER SECTION:
> app.hubspot.com. 5 IN CNAME wg.custom.block.custom.block.
> wg.custom.block.custom.block. 180 IN A 172.19.2.3
>
>
> Regards,
> Lee
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from
this list
ISC funds the development of this software with paid support subscriptions.
Contact us at https://www.isc.org/contact/ for more information.
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
