diff options
| author | Igor Melnyk <igor_melnyk@ukr.net> | 2021-05-05 23:18:34 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-05-05 22:18:34 +0200 |
| commit | 25ba7e113a81ec30953dbfe8c78657473c1f5412 (patch) | |
| tree | 735ee401ea3d31405dab06d5c88638db6142467f /docs/configuration/service | |
| parent | 7f2e8b70e83c3c9516608c6b1e261a428efad707 (diff) | |
| download | vyos-documentation-25ba7e113a81ec30953dbfe8c78657473c1f5412.tar.gz vyos-documentation-25ba7e113a81ec30953dbfe8c78657473c1f5412.zip | |
dns: T3277: support no reverse zones rfc1918 lookup
Diffstat (limited to 'docs/configuration/service')
| -rw-r--r-- | docs/configuration/service/dns.rst | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/docs/configuration/service/dns.rst b/docs/configuration/service/dns.rst index 0a65161b..48708dfa 100644 --- a/docs/configuration/service/dns.rst +++ b/docs/configuration/service/dns.rst @@ -108,6 +108,12 @@ avoid being tracked by the provider of your upstream DNS server. The local IPv4 or IPv6 addresses to bind the DNS forwarder to. The forwarder will listen on this address for incoming connections. +.. cfgcmd:: set service dns forwarding no-server-rfc1918 + + This makes the server authoritatively not aware of: 10.in-addr.arpa, + 168.192.in-addr.arpa, 16-31.172.in-addr.arpa, which enabling upstream + DNS server(s) to be used for reverse lookups of these zones. + Example ======= @@ -124,6 +130,8 @@ In this scenario: interface addresses - 192.168.1.254 for IPv4 and 2001:db8::ffff for IPv6 * The VyOS DNS forwarder will only accept lookup requests from the LAN subnets - 192.168.1.0/24 and 2001:db8::/64 +* The VyOS DNS forwarder will pass reverse lookups for 10.in-addr.arpa, + 168.192.in-addr.arpa, 16-31.172.in-addr.arpa zones to upstream server. .. code-block:: none @@ -137,6 +145,7 @@ In this scenario: set service dns forwarding listen-address 2001:db8::ffff set service dns forwarding allow-from 192.168.1.0/24 set service dns forwarding allow-from 2001:db8::/64 + set service dns forwarding no-serve-rfc1918 Operation ========= |