Table of Contents
Networking - DNS - Unbound - Tags
Tags make it possible to divide client source addresses into categories (tags), and use local-zone and local-data information for these specific tags.
tags was introduced in Unbound 1.5.10.
IMPORTANT: The tags on the netblocks and local-zones are stored in bitmaps, it is therefore advised to keep the number of tags low.
- If a lot of clients have their own local-zones, without sharing these to other netblocks, it can results in lots of tags.
- In this situation it is more convenient to give the client's netblock its own tree containing local-zones.
- Another benefit of having a separate local zone tree is that it makes it possible to apply a local-zone action to a part of the domain space, without having other local-zone elements of subdomains overriding this.
- Configuring a client specific local-zone tree can be done using Views.
Define Tags
define-tags: "malware gambling"
NOTE: This defines two tags, one for domains containing malware, and one for domains of gambling sites.
Specify what tag to use for specific client addresses
access-control-tag: 10.0.1.0/24 "malware" access-control-tag: 10.0.2.0/24 "malware" access-control-tag: 10.0.3.0/24 "gambling" access-control-tag: 10.0.4.0/24 "malware gambling"
NOTE: It is possible to add multiple tags to an access-control element.
- Other client addresses not within an access-control-tag will still be allowed by default.
Add tags to local-zones
local-zone: malwarehere.example refuse local-zone: somegamblingsite.example static local-zone: matchestwotags.example transparent local-zone: notags.example inform local-zone-tag: malwarehere.example malware local-zone-tag: somegamblingsite.example malware local-zone-tag: matchestwotags.example "malware gambling"
NOTE: The local-zone type can be:
- deny serves local data (if any), else, drops queries.
- refuse serves local data (if any), else, replies with error.
- static serves local data, else, nxdomain or nodata answer.
- transparent gives local data, but resolves normally for other names.
- redirect serves the zone data for any subdomain in the zone.
- nodefault can be used to normally resolve AS112 zones.
- typetransparent resolves normally for other types and other names.
- inform acts like transparent, but logs client IP address.
- inform_deny drops queries and logs client IP address.
- inform_redirect redirects queries and logs client IP address
- always_transparent resolve in that way but ignore local data for that name.
- always_refuse resolve in that way but ignore local data for that name.
- always_nxdomain resolve in that way but ignore local data for that name.
- noview breaks out of that view towards global local-zones.
NOTE: A local-zone-tag can have multiple tags.
- The tagged local-zones will be used if one or more tags match the client.
- E.g. the matchestwotags.example local-zone will be used for all clients with at least the malware or gambling tag.
- The used local-zone type will be the type specified in the matching local-zone.
- It is possible to depend the local-zone type on the client address and tag combination.
Optionally, set tag specific local-zone types
access-control-tag-action: 10.0.1.0/24 "malware" refuse access-control-tag-action: 10.0.2.0/24 "malware" deny
NOTE: This sets the local-zone type depending on the client address and tag combination.
Optionally, use local-data RRs (resource records)
access-control-tag-data: 10.0.4.0/24 "gambling" "A 127.0.0.1"
NOTE: This sets the use of local-data RRs for some specific client address/tag match.
NOTE: Sometimes you might want to override a local-zone type for a specific netblock, regardless the type configured for tagged and untagged localzones, and regardless the type configured using access-control-tag action.
- This override can be done using local-zone-override.