Intercepting addrs in a DNS server

[UnknownPerson]

I have a school where small children use computers. People just love to see violence and sex. The good thing is that they always do that in the same sites all the time.

My doubt is: How can I block those sites in my DNS server?. Whe have our own DNS server running Debian Potato and I would like to do something like this:

nslookup

http://www.somenastybadsite.com

To be resolved to: forbidenpage.myinternalpageserver

So I would show up a page on the students browser saying they are not allowed to view that page. How could this be done?.

Thanks to anyone who inputs.

 

[sleipnir214]

Create a zone record for the offending domain. Make the offending website's address resolve to your own servers. The answer won't be authoritative, but it'll block access.

Anyone inside your network will get your page. It won't affect anyone outside your network.

Remember, though, that all someone has to do to bypass this is to reconfigure their network settings to use DNSs other than yours. Perfection in engineering does not happen when there is nothing more to add. Rather it happens when there is nothing more to take away.

 

[UnknownPerson]

Can you give me an example or reference to creating zone records?

Sorry for any trouble.

 

[sleipnir214]

What DNS software are you running? Perfection in engineering does not happen when there is nothing more to add. Rather it happens when there is nothing more to take away.

 

[abovebrd]

A simpler approach might be to block complete IP access to the affending domain.

route add -net 10.1.1.1 netmask 255.255.255.255 reject

If your using a cisco router a simpler approach might be to use an access list on the router.



-Danny
dan@snoboarder.net

 

[jrjuiliano]

Here's another option that's been discussed on the IPCOP firewall user list; dansguardian.

http://dansguardian.org/

Something to check out, anyway...
J.R. Juiliano
Information Systems Specialist
Tri-City Emergency Medical Group

 

[UnknownPerson]

I am using Berkeley Internet Names Domain v8.

 

[sleipnir214]

Do you have any live domains listed on that server, or are you using it only for caching? Perfection in engineering does not happen when there is nothing more to add. Rather it happens when there is nothing more to take away.

 

[UnknownPerson]

Only as a caching server. I didn´t even guet to configure it, just intall it from the deb package.

 

[sleipnir214]

Then you might be best served reading the BIND 8 HOWTO

http://langfeldt.net/DNS-HOWTO/BIND-8/

There are a lot of options that would be difficult to discuss in the forum that that document should answer for you.

Perfection in engineering does not happen when there is nothing more to add. Rather it happens when there is nothing more to take away.