Administration tool for IPv4/IPv6 TCP/UDP packet filtering.
##build & install see https://github.com/mimuret/iptables-ext-dns/wiki/install
dns match options:
[!] --qr match when response
[!] --opcode match
(Flags QUERY,IQUERY,STATUS,NOTIFY,UPDATE)
[!] --aa match when Authoritative Answer
[!] --tc match when Truncated Response
[!] --rd match when Recursion Desired
[!] --ra match when Recursion Available
[!] --ad match when Authentic Data
[!] --cd match when checking Disabled
[!] --qname
[!] --qtype
(Flags ex. A,AAAA,MX,NS,TXT,SOA... )
see. http://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml
[!] --reverse-match --rmatch reverse matching flag
[!] --maxsize qname max size
Qname size is not domain string length. For example "www.example.jp." string length is 15, but qname size is 16. For more information, see RFC1035.
qname
option default match mode is exact match.
This sample matches 'example.jp', but not matches 'hogehoge.example.jp'.
iptables -A INPUT -m dns --qname example.jp -j ACCEPT
ip6tables -A INPUT -m dns --qname example.jp -j ACCEPT
rmatch
option changes match mode to reverse match.
This sample matches 'example.jp' and 'hogehoge.example.jp,'.
iptables -A INPUT -m dns --rmatch --qname example.jp -j DROP
ip6tables -A INPUT -m dns --rmatch --qname example.jp -j DROP
maxsize
option provide qname size filtering.
This sample not matches 'example.jp.' and 'hogehoge.example.jp.'.
but 'OJcoaTh297tDwtkNCAV2vtLwh3P0S6Ldce6Oas0Sug6YJGCniluVLoEPBBIOTEr.example.jp.' is matched
iptables -A INPUT -m dns --rmatch --qname example.jp ! --maxsize 64 -j DROP
ip6tables -A INPUT -m dns --rmatch --qname example.jp ! --maxsize 64 -j DROP
'qtype' option provide qtype filter.
This sample is drop query when type is ANY.
iptables -A INPUT -m dns --qtype ANY -j DROP
ip6tables -A INPUT -m dns --qtype ANY -j DROP