Setting up A DNSBL service for Safesquid

Setting up A DNSBL service for Safesquid

Setting up A DNSBL service for Safesquid
You could be frequently discovering websites that your enterprise may choose to block for all users.
Various SOC service providers supply lists of websites that may be malignant or inappropriate.
You could add such sites into a category using the Custom Category feature of SafeSquid.
Creating an entry in Access Profiles to block access to such categories, would prevent users from accessing such sites.
However, if you have a large number of such websites being supplied by your SOC provider, using SafeSquid’s DNS Blacklist feature may be a better alternative.
Enabling SafeSquid’s DNS Blacklist feature, causes safesquid to query the A record of a website’s domain in the DNSBL.
For example, if a user seeks to access www.google.com, and you have configured in.dnsbl.org as your DNSBL,
SafeSquid queries for the A record of www.google.com.in.dnsbl.org, before actually connecting to www.google.com
If the A record is found to fall within the configured range, access to www.google.com would be blocked.
Managing DNSBL, or checking if a website is being blocked does not require access to SafeSquid’s UI or credentials to the self-service portal at key.safesquid.com
Also, if you have other applications that can benefit from DNS based blocking, the return on your efforts simply multiplies.
To setup your DNSBL on a standard bind9 implementation follow the following steps.
First you would choose a domain name for your DNSBL.
This domain name need not be an officially purchased or registered, just any name is fine.
For this example, we are choosing in.dnsbl.org
Create a zone definition.
You may set this definition in /etc/bind/named.conf.local because it is usually included already in /etc/bind/named.conf
or if you prefer to create a new file, make sure to include it in 
  1. /etc/bind/named.conf
  2. zone "in.dnsbl.org" {
  3.        type master;
  4.        file "/etc/bind/db.in.dnsbl.org";
  5.        allow-transfer { any; };
  6.        allow-query { any; };
  7. };
Now populate zone data file /etc/bind/db.in.dnsbl.org as follows
  1. ;
  2. ; BIND data file for TLD ".in.dnsbl.org"
  3. ;
  4. $TTL    604800
  5. @    IN    SOA    in.dnsbl.org. root.in.dnsbl.org. (
  6.                   2        ; Serial
  7.              3600        ; Refresh
  8.               86400        ; Retry
  9.             3600        ; Expire
  10.              3600 )    ; Negative Cache TTL
  11. @      IN    NS    ns1.in.dnsbl.org.
  12. @      IN    NS    ns2.in.dnsbl.org.
  13. @      IN    A    <ip-address-of-your-dnsbl-server>
  14. ns1      IN    A    <ip-address-of-your-dnsbl-server>
  15. ns2      IN    A     <ip-address-of-your-dnsbl-server>
  16. blocked    IN     A    127.0.0.4
  17. allowed   IN    A       127.0.0.100
  18. *         IN    CNAME           allowed
  19. *.com     IN    CNAME           allowed
  20. example.com      IN     CNAME    blocked
  21. example.net  IN    CNAME    blocked
  22. blocktest1   IN    CNAME    blocked
  23. testblock.com IN    CNAME    blocked
Note: We have added example.com, example.net, blocktest1, testblock.com as just reference examples
Once populated as desired just reload the bind9 service:
  1. service bind9 reload
now check if things are working as desired:
  1. host -t A example.com.in.dnsbl.org
The result should appear as:
  1. rediff.com.in.dnsbl.org 1 is an alias for blocked.in.dnsbl.org.
  2. blocked.in.dnsbl.org has address 127.0.0.4
and
  1. host -t A test.com.in.dnsbl.org
The result should appear as:
  1. test.com.in.dnsbl.org is an alias for allowed.in.dnsbl.org.
  2. allowed.in.dnsbl.org has address 127.0.0.100
Configure SafeSquid as described in https://docs.safesquid.com/wiki/DNS_blacklist
Note: Standard SafeSquid installations normally co-host a bind9 implementation
So, if you prefer you can extend its capabilities, rather than setup a dedicated DNSBL
If you have a cluster of SafeSquid instances, it is recommended to either setup the above in a “master instance”, or create a dedicated DNSBL service.
You can then easily serve all SafeSquid instances by adding just the following to the bind9 configuration /etc/bind/named.conf.local
  1. zone in.dnsbl.org {
  2.     type stub;
  3.     masters { <ip-address-of-your-dnsbl-server> ;};
  4. };