How to filter private IP space from DNS_RESPONSE

OK, sorry.

That was just an quick example. The goal was the NXDOMAIN in the answer.

If you need to clear only internal address to an external response, maybe you can try like this:

when DNS_RESPONSE {
    if { not [class match [IP::client_addr] eq "local_net"] } {
        remove internal IP from external answer
        foreach rr [DNS::answer] {
            if { [DNS::type $rr] eq "A" } {
                if { [class match [DNS::rdata $rr] eq private_net] } {
                    DNS::answer remove $rr
                }
            }
        }
        if query type any
        remove internal IP from additional external answer
        foreach rr [DNS::additional] {
            if { [DNS::type $rr] eq "A" } {
                if { [class match [DNS::rdata $rr] eq private_net] } {
                    DNS::additional remove $rr
                }
            }
        }
        if response empty
        if { [DNS::answer] eq "" } {
            DNS::header rcode NXDOMAIN
        }
    }
}

Respectfully.