Sign inSign up

patterns/sinkhole

By patterns

•Updated about 6 years ago

DNS sinkhole

Image
0

1.1K

patterns/sinkhole repository overview

s6e

⁠sinkhole

Following the generate-domains-blacklist.py Python script that is part of dnscrypt-proxy⁠. Started as steps from github.com/oznu/dns-zone-blacklist using Golang.

Get it from the Snap Store

⁠Quickstart

  1. Install Docker⁠
  2. Git clone the repo⁠
  3. Build and run:
$ cd sinkhole
$ docker build -t sinkhole .
$ docker run -ti -p 5300:5300/udp sinkhole
  1. Baseline DNS:
$ dig @127.0.0.1 -p 5300 adafruit.com

Which shows the domain has round-robin between 104.20.38.240 and 104.20.39.240. So far so good.

  1. Verify blocking:
$ dig @127.0.0.1 -p 5300 doubleclick.net

The result will be 0.0.0.0 which means success!

⁠Port

To choose the port, either pass a build arg to docker or use your own config file.

Example of the build arg:

$ docker build --build-arg PORT=5353 -t sinkhole .

Example of the config file approach:

$ curl -o dns.toml https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml
$ nano dns.toml
#search for the bind line
    [127.0.0.1:53]
$ docker run -ti -p 5353:5353/udp -v $(pwd):/opt/mydns sinkhole -c /opt/mydns/dns.toml

⁠Credits

dnscache from djbdns⁠

cloudflared Argo Tunnel by CloudFlare⁠(LICENSE⁠)

DNS library by Miek Gieben⁠(LICENSE⁠)

dnscrypt-proxy by Frank Denis⁠(LICENSE⁠)

Unbound image by Kyle Harding⁠(LICENSE⁠)

BIND, Dnsmasq, Unbound blacklist project⁠

Unified hosts file by Steven Black⁠ (LICENSE⁠)

Pi-hole guide on recursive DNS⁠

Archlinux config of Unbound⁠

sync/errgroup⁠

⁠Notes

- raspberry pi 4
- ubuntu-server arm64 image
- ip a (wlan0)
- /etc/netplan/wireless.yaml (from /usr/share/doc/cloud-init/examples)
- sudo netplan --debug try/generate/apply
- sudo apt update -y && sudo apt upgrade -y && sudo apt dist-upgrade -y
- sudo apt install -y unbound
- sudo vi /etc/unbound/unbound.conf.d/pihole.conf (see pi-hole guide for unbound recursive dns)
- curl -o unbound.bl https://raw.githubusercontent.com/oznu/dns-zone-blacklist/master/unbound/unbound.blacklist
- sudo systemctl stop systemd-resolved
- sudo vi /etc/systemd/resolved.conf
- sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
- sudo ufw allow in on wlan0 from 192.168.0.0/16 to any port 53
- sudo ufw enable
- sudo ufw status
- sudo echo "127.0.0.1 pihole" >> /etc/hosts
- sudo rm /etc/hostname && echo pihole > /etc/hostname
- optionally, touch /etc/cloud/cloud-init.disabled

Tag summary

Content type

Image

Digest

Size

6.2 MB

Last updated

about 6 years ago

docker pull patterns/sinkhole