This is a DNS Proxy server that supports black list and written in Python using dnslib library.
This proxy server supports both TCP and UDP and can run them at both time.
It supports all main package types such as:
A - IPv4 address
AAAA - IPv6 address
NS - Name server
CNAME - Canonical name
SOA - Start of authority
MX - Mail exchange
SRV - Service record
User sends a DNS request to the proxy server.
This request is handled by handler, where the request is checked against the black list.
If it is, the second check is made to see if we need to resolve the request to a different IP address.
If the IP address where to resolve is in config file, we return the response packet with the new IP address.
If not, we return the response packet with no IP address.
If domain in not in black list, we send the request to the upstream DNS Server and return the response packet.
The first thing to do is to specify upstream DNS server in config file(or you can pass it as a command line argument).
Then you can specify black list file in config file(if needed).
Then the server can be started by running the following command: sudo python3 main.py
In this particular case the server will run on its default port (53) and will listen on all addresses,
upstreaming the queries to configfile upstream server address. Only UDP datagrams will be accepted.
-p, --port: Local proxy port (default: 53)
-a, --address: Local proxy address (default: all)
-u, --upstream: Upstream DNS server address ( IP:PORT format (default: None) )
--tcp: Enable TCP connections listening (default: False)
--timeout: Upstream server timeout (default: 5)
--strip-aaaa: Returns NXDOMAIN for AAAA queries(default: off)
*this arg is used with resolver.
Since we use PassThroughDNSHandler to send packets directly to upstream server, this flag makes no difference
--log: Log hooks to enable (default: +request,+reply,+truncated,+error,-recv,-send,-data)
--log-prefix: Log prefix (timestamp/handler/resolver) (default: False)
You can use dig command to test your DNSProxy server.
For example:
dig @<your_dns_server_ip> -p <your_dns_port> google.com
Or change your DNS server to your DNSProxy server IP address and port in your network settings.
Then you can test it by opening your browser and going to google.com.
To do this open by text editor your /etc/resolv.conf file and add the following line:
nameserver <your_dns_server_ip>