Forum Discussion

james_hodgkinso's avatar
james_hodgkinso
Icon for Nimbostratus rankNimbostratus
Aug 28, 2018

DNS Caches and iRules

I've got a VIP handling DNS requests with a transparent cache profile on it, and I'm trying to stop queries certain zones by sending an NXDOMAIN automatically. Is it correct to assume that this'll somehow be bypassed by the cache? It seems to be the case.

My iRule is as follows (it also points some internal domains to other nameservers):

when DNS_REQUEST {
    set query [string tolower [DNS::question name]]
    set dns_pool [class match -value -- $query ends_with dg_dns_steering]
    if [ $dns_pool eq "pool_dns_NXDOMAIN" ] {
        log local0. "nxdomain $query"
        DNS::answer clear
        DNS::header rcode NXDOMAIN
        DNS::return
    } else {
        pool $dns_pool
    }
}

And the datagroup has "example.com" : "pool_dns_NXDOMAIN" for example.

I can see it's working, because I get log events, but I can still see queries going out with tcpdump.

application delivery
iRules
LTM
security
  • iaine's avatar
    iaine
    Icon for Nacreous rankNacreous
    Aug 30, 2018

    Hi

    Apart from a bracket issue on you if line - should be { rather than [

    if { $dns_pool eq "pool_dns_NXDOMAIN" } {

    which i'm guessing is a copy and paste issue as the code wouldn't work otherwise then your code works for me. When querying the VIP I can see requests for all of me DNS suffixes hitting the DNS servers but the call for the specific host in the Data Group gets served by the iRule.

    Changing your code tocontains dg_dns_steering tidied this up for me.