CoreDNS: drop all private ip PTR lookup

Jbn1233
Dec 23, 2022

--

For some reasons, I need to stop sending reverse lookup to public DNS. This is how:

    template IN PTR in-addr.arpa {
match ^(?P<d>[0-9]*)[.](?P<c>[0-9]*)[.](?P<b>[0-9]*)[.](?P<a>10*)[.]in-addr[.]arpa[.]$
match ^(?P<d>[0-9]*)[.](?P<c>[0-9]*)[.](?P<b>[1][6-9]|[2][0-9]|[3][0-1]*)[.](?P<a>172*)[.]in-addr[.]arpa[.]$
match ^(?P<d>[0-9]*)[.](?P<c>[0-9]*)[.](?P<b>168*)[.](?P<a>192*)[.]in-addr[.]arpa[.]$
rcode NXDOMAIN
fallthrough
}

This will take care all below IP-address:

10.0.0.0 – 10.255.255.255
172.16.0.0 – 172.31.255.255
192.168.0.0 – 192.168.255.255

Instead of NXDOMAIN, we can response with custom PTR:

    template IN PTR in-addr.arpa {
match ^(?P<d>[0-9]*)[.](?P<c>[0-9]*)[.](?P<b>[0-9]*)[.](?P<a>10*)[.]in-addr[.]arpa[.]$
match ^(?P<d>[0-9]*)[.](?P<c>[0-9]*)[.](?P<b>[1][6-9]|[2][0-9]|[3][0-1]*)[.](?P<a>172*)[.]in-addr[.]arpa[.]$
match ^(?P<d>[0-9]*)[.](?P<c>[0-9]*)[.](?P<b>168*)[.](?P<a>192*)[.]in-addr[.]arpa[.]$
match ^(?P<d>[0-9]*)[.](?P<c>[0-9]*)[.](?P<b>169*)[.](?P<a>192*)[.]in-addr[.]arpa[.]$
answer "{{ .Name }} 60 IN PTR host-{{ .Group.a }}-{{ .Group.b }}-{{ .Group.c }}-{{ .Group.d }}.cluster.local."
fallthrough
}

Done.

--

--

Jbn1233
Jbn1233

Written by Jbn1233

Very short and simple notes for CKA/SRE and may not works on your environment | jbn1233@gmail.com | Bangkok, Thailand |

No responses yet