I can understand that this naming tradition... isn't great.
==============
Views allow to differentiate resolver behavior based on "who asked the query".
-This allows you to achieve access control, personalized blacklists and filters based on how the DNS request came.
+This allows you to achieve access control, personalized blocklists and filters based on how the DNS request arrived.
.. code-block:: yaml
# refuse everything that hasn't matched
- subnets: [ 0.0.0.0/0, "::/0" ]
answer: refused
- # whitelist queries identified by subnet
+ # allow queries identified by subnet
- subnets: [ 192.0.2.0/24 ]
answer: allow
})
-- Apply RPZ for all clients, default rule is DENY
-policy.add(policy.rpz(policy.DENY, 'blacklist.rpz'))
+policy.add(policy.rpz(policy.DENY, 'blocklist.rpz'))
# refuse everything that hasn't matched
- subnets: [ 0.0.0.0/0, "::/0" ]
answer: refused
- # whitelist queries identified by subnet
+ # allow queries identified by subnet
- subnets: [ 192.0.2.0/24 ]
answer: allow
local-data:
rpz:
# apply RPZ for all clients, default rule is DENY
- - file: blacklist.rpz
+ - file: blocklist.rpz
lua:
script: |
local monitor_id = event.recurrent(1 * minute, speed_monitor())
-- apply RPZ for all clients, default rule is DENY
-policy.add(policy.rpz(policy.DENY, 'blacklist.rpz'))
+policy.add(policy.rpz(policy.DENY, 'blocklist.rpz'))
-- whitelist queries identified by subnet
view:addr(''192.168.1.0/24'', policy.all(policy.PASS))
Let the query pass through; it's useful to make exceptions before wider rules. For example:
- More specific whitelist rule must precede generic blacklist rule:
+ More specific whitelist rule must precede generic blocklist rule:
.. code-block:: lua
==============
The :ref:`policy <mod-policy>` module implements policies for global query matching, e.g. solves "how to react to certain query".
-This module combines it with query source matching, e.g. "who asked the query". This allows you to create personalized blacklists, filters and ACLs.
+This module combines it with query source matching, e.g. "who asked the query". This allows you to create personalized blocklists, filters and ACLs.
There are two identification mechanisms: