ahupowerdns

local-address=0.0.0.0
launch=gsqlite3
gsqlite3-database=/etc/powerdns/powerdns.sqlite3
master
daemon
guardian

ahupowerdns

pi@raspberrypi ~ $ /sbin/ifconfig eth0 | head -1
eth0      Link encap:Ethernet  HWaddr b8:27:eb:0c:88:27  
pi@raspberrypi ~ $ dig www.ds9a.xxx @192.168.5.24 +short
blockingserver.powerdns.com.

ahu@ahucer:~$ /sbin/ifconfig eth0 | head -1
eth0      Link encap:Ethernet  HWaddr 90:fb:e9:3b:61:dc
ahu@ahucer:~$ dig www.ds9a.xxx @192.168.5.24
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 10412

ahupowerdns

-- load this and the previous snippet as 'lua-dns-script=macfilter.lua' 
function macPrint(a)
        return string.format("%02x:%02x:%02x:%02x:%02x:%02x", a:byte(1), a:byte(2), a:byte(3), a:byte(4), a:byte(5), a:byte(6))
end

function preresolve(dq)
        print("Got question for "..dq.qname:toString().." from "..dq.remoteaddr:toString().." to "..dq.localaddr:toString())

        local a=dq:getEDNSOption(65001)
        if(a ~= nil) then

ahupowerdns

filter={}
filter["192.168.5.24"]={["b8:27:eb:0c:88:27"]=1, ["00:0d:b9:36:6f:79"]= 1}
filter["10.0.0.1"]={["06:31:25:7a:84:6b"]=1}

-- note that the filtering could be more than binary, but specify lots of categories
-- see https://i.imgur.com/wGwNHl7.png for inspiration
baddomains=newDS()
baddomains:add("xxx")

ahupowerdns

addLocal("0.0.0.0")
newServer("192.168.5.123:5300")
addAction(AllRule(), MacAddrAction(65001)) 
-- using LuaAction, the MAC address could be hashed or truncated, for increased privacy

ahupowerdns

$ pdnsutil create-zone ds9a.nl ns1.powerdns.com
Creating empty zone 'ds9a.nl.'
Also adding one NS record

$ pdnsutil add-record ds9a.nl @ A 1.2.3.4
$ pdnsutil add-record ds9a.nl "*" CNAME ds9a.nl
$ pdnsutil list-zone ds9a.nl
*.ds9a.nl.      3600    IN      CNAME   ds9a.nl.
ds9a.nl.        3600    IN      A       1.2.3.4 

ahupowerdns

adservers=newDS()
adservers:add(dofile("blocklist.lua"))
-- optionally: adservers:add(dofile("trackers.lua"))

filterset=newCAS()
filterset:add(dofile("filtercustomers.lua"))

function preresolve(dq)
    if(not adservers:check(dq.qname) or (dq.qtype ~= pdns.A and dq.qtype ~= pdns.AAAA)) then
        return false

ahupowerdns

  (echo return{; 
  for z in {1..10}
  do for a in {1..255}
  do for b in {1..255}
  do echo \"10.$z.$a.$b\",
  done ; done; done
  echo } ) > filtercustomers.lua

ahupowerdns

adservers=newDS()
adservers:add(dofile("blocklist.lua"))

function preresolve(dq)
    if(not adservers:check(dq.qname) or (dq.qtype ~= pdns.A and dq.qtype ~= pdns.AAAA)) then
        return false
    end

    dq:addRecord(pdns.SOA,
        "fake."..dq.qname:toString().." fake."..dq.qname:toString().." 1 7200 900 1209600 86400",

ahupowerdns

(
echo 'return{'
for a in $(jq '.[].trigger["url-filter"]' disconnect-advertising.json  | 
           cut -f3 -d? | sed 's:\\\\.:.:g' | sed s:\"::)
do 
   echo \"$a\", 
done 
echo '}'
) > blocklist.lua