aboutsummaryrefslogtreecommitdiff
path: root/plugin/acl/README.md
blob: 5103018ef037d58f9df2d69016b0da27be192585 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
# acl

## Name

*acl* - enforces access control policies on source ip and prevents unauthorized access to DNS servers.

## Description

With `acl` enabled, users are able to block or filter suspicious DNS queries by configuring IP filter rule sets, i.e. allowing authorized queries to recurse or blocking unauthorized queries.

This plugin can be used multiple times per Server Block.

## Syntax

```
acl [ZONES...] {
    ACTION [type QTYPE...] [net SOURCE...]
}
```

- **ZONES** zones it should be authoritative for. If empty, the zones from the configuration block are used.
- **ACTION** (*allow*, *block*, or *filter*) defines the way to deal with DNS queries matched by this rule. The default action is *allow*, which means a DNS query not matched by any rules will be allowed to recurse. The difference between *block* and *filter* is that block returns status code of *REFUSED* while filter returns an empty set *NOERROR*
- **QTYPE** is the query type to match for the requests to be allowed or blocked. Common resource record types are supported. `*` stands for all record types. The default behavior for an omitted `type QTYPE...` is to match all kinds of DNS queries (same as `type *`).
- **SOURCE** is the source IP address to match for the requests to be allowed or blocked. Typical CIDR notation and single IP address are supported. `*` stands for all possible source IP addresses.

## Examples

To demonstrate the usage of plugin acl, here we provide some typical examples.

Block all DNS queries with record type A from 192.168.0.0/16:

~~~ corefile
. {
    acl {
        block type A net 192.168.0.0/16
    }
}
~~~

Filter all DNS queries with record type A from 192.168.0.0/16:

~~~ corefile
. {
    acl {
        filter type A net 192.168.0.0/16
    }
}
~~~

Block all DNS queries from 192.168.0.0/16 except for 192.168.1.0/24:

~~~ corefile
. {
    acl {
        allow net 192.168.1.0/24
        block net 192.168.0.0/16
    }
}
~~~

Allow only DNS queries from 192.168.0.0/24 and 192.168.1.0/24:

~~~ corefile
. {
    acl {
        allow net 192.168.0.0/24 192.168.1.0/24
        block
    }
}
~~~

Block all DNS queries from 192.168.1.0/24 towards a.example.org:

~~~ corefile
example.org {
    acl a.example.org {
        block net 192.168.1.0/24
    }
}
~~~

## Metrics

If monitoring is enabled (via the _prometheus_ plugin) then the following metrics are exported:

- `coredns_acl_blocked_requests_total{server, zone}` - counter of DNS requests being blocked.

- `coredns_acl_allowed_requests_total{server}` - counter of DNS requests being allowed.

The `server` and `zone` labels are explained in the _metrics_ plugin documentation.
ion> Unnamed repository; edit this file 'description' to name the repository.
aboutsummaryrefslogtreecommitdiff
path: root/src/react-refresh.js (unfollow)
AgeCommit message (Expand)AuthorFilesLines
2023-09-20feat(runtime): implement `console._stdout` (#5842)Gravatar dave caruso 2-1/+59
2023-09-20Improve types for `test.each`, `describe.each` (#5838)Gravatar Colin McDonnell 2-10/+59
2023-09-20Fix rendering of bun.lockb in vscode extensionGravatar Ashcon Partovi 5-114/+4
2023-09-20Run bun fmtGravatar Ashcon Partovi 2-12/+9
2023-09-20Update quickstartGravatar Colin McDonnell 1-0/+19
2023-09-20Update prisma guideGravatar Colin McDonnell 1-0/+6
2023-09-20Update env docGravatar Colin McDonnell 1-1/+1
2023-09-20Clarify hot modeGravatar Colin McDonnell 1-10/+9
2023-09-20[bun install] Add `-E` as alias of `--exact` (#5104)Gravatar Jonah Snider 2-2/+57
2023-09-20feat: switch disableTelemetry to bunfig (#5690)Gravatar Lucas Coratger 3-1/+14
2023-09-20Treat `undefined` value as empty in expect.toThrow (#5788)Gravatar LongYinan 1-3/+3
2023-09-20Fix various bugs in vscode extension (#5772)Gravatar JeremyFunk 3-9/+85
2023-09-20add `emitDecoratorMetadata` (#5777)Gravatar Dylan Conway 19-110/+1884
2023-09-20fix(doc): correct `server.reload` (#5799)Gravatar Ai Hoshino 1-1/+1
2023-09-20Call `Error.prepareStackTrace` on `new Error().stack` (#5802)Gravatar Jarred Sumner 6-155/+277
2023-09-20Fixes #5800Gravatar Jarred Sumner 1-1/+1
2023-09-20Fix path used in bunx (#5785)Gravatar Jarred Sumner 2-26/+51
2023-09-20Fix RedirectURLTooLong errors (#5786)Gravatar ggobbe 1-1/+1
2023-09-19Show when a newer version is available in the install screen (#5780)Gravatar Jarred Sumner 3-14/+95
2023-09-19Fix broken linksGravatar Colin McDonnell 4-4/+4