History

Miek Gieben b003d06003 For caddy v1 in our org (#4018 ) * For caddy v1 in our org This RP changes all imports for caddyserver/caddy to coredns/caddy. This is the v1 code of caddy. For the coredns/caddy repo the following changes have been made: * anything not needed by us is deleted * all `telemetry` stuff is deleted * all its import paths are also changed to point to coredns/caddy * the v1 branch has been moved to the master branch * a v1.1.0 tag has been added to signal the latest release Signed-off-by: Miek Gieben <miek@miek.nl> * Fix imports Signed-off-by: Miek Gieben <miek@miek.nl> * Group coredns/caddy with out plugins Signed-off-by: Miek Gieben <miek@miek.nl> * remove this file Signed-off-by: Miek Gieben <miek@miek.nl> * Relax import ordering github.com/coredns is now also a coredns dep, this makes github.com/coredns/caddy fit more natural in the list. Signed-off-by: Miek Gieben <miek@miek.nl> * Fix final import Signed-off-by: Miek Gieben <miek@miek.nl>		2020-09-24 18:14:41 +02:00
..
acl.go	fix spelling mistakes (#3364 )	2019-10-09 07:24:18 +00:00
acl_test.go	For caddy v1 in our org (#4018 )	2020-09-24 18:14:41 +02:00
metrics.go	using promauto package to ensure all created metrics are properly registered (#4025 )	2020-07-25 08:06:28 -07:00
README.md	Fix CIDR in example (#3864 )	2020-04-28 10:46:20 -04:00
setup.go	For caddy v1 in our org (#4018 )	2020-09-24 18:14:41 +02:00
setup_test.go	For caddy v1 in our org (#4018 )	2020-09-24 18:14:41 +02:00

README.md

acl

Name

acl - enforces access control policies on source ip and prevents unauthorized access to DNS servers.

Description

With acl enabled, users are able to block suspicious DNS queries by configuring IP filter rule sets, i.e. allowing authorized queries to recurse or blocking unauthorized queries.

This plugin can be used multiple times per Server Block.

Syntax

acl [ZONES...] {
    ACTION [type QTYPE...] [net SOURCE...]
}

ZONES zones it should be authoritative for. If empty, the zones from the configuration block are used.
ACTION (allow or block) defines the way to deal with DNS queries matched by this rule. The default action is allow, which means a DNS query not matched by any rules will be allowed to recurse.
QTYPE is the query type to match for the requests to be allowed or blocked. Common resource record types are supported. * stands for all record types. The default behavior for an omitted type QTYPE... is to match all kinds of DNS queries (same as type *).
SOURCE is the source IP address to match for the requests to be allowed or blocked. Typical CIDR notation and single IP address are supported. * stands for all possible source IP addresses.

Examples

To demonstrate the usage of plugin acl, here we provide some typical examples.

Block all DNS queries with record type A from 192.168.0.0/16：

. {
    acl {
        block type A net 192.168.0.0/16
    }
}

Block all DNS queries from 192.168.0.0/16 except for 192.168.1.0/24:

. {
    acl {
        allow net 192.168.1.0/24
        block net 192.168.0.0/16
    }
}

Allow only DNS queries from 192.168.0.0/24 and 192.168.1.0/24:

. {
    acl {
        allow net 192.168.0.0/24 192.168.1.0/24
        block
    }
}

Block all DNS queries from 192.168.1.0/24 towards a.example.org:

example.org {
    acl a.example.org {
        block net 192.168.1.0/24
    }
}

Metrics

If monitoring is enabled (via the prometheus plugin) then the following metrics are exported:

coredns_acl_blocked_requests_total{server, zone} - counter of DNS requests being blocked.
coredns_acl_allowed_requests_total{server} - counter of DNS requests being allowed.

The server and zone labels are explained in the metrics plugin documentation.