This is a custom configuration of DNSMASQ that can be used on a edge node to provide filtering and security services.
The first step is to provide suitable DNS servers for the edge node resolv.conf file. We provide two variants.
The first variant provides services that include filtering insecure IP addresses:
9.9.9.9 # Quad9
1.1.1.2 # Cloudflare
208.67.222.222 # OpenDNS
The second variant includes the above as well as adult related site blocking:
1.1.1.3 # Cloudflare
208.67.222.123 # OpenDNS
94.140.14.15 #AdGuard
The following custom DNSMASQ configuration file can be used:
cache-size=4096
min-cache-ttl=900
all-servers
The next step is to create a custom-daily.sh script that daily downloads hosts files that provide the ability for DNSMASQ to filter and provide security.
#!/bin/bash
# Daily script which updates DNSMASQ categories
# Location: /usr/local/sbin
threatblock_dir="/etc/extra/MASQF"
sudo mkdir -p /etc/extra
sudo mkdir -p "$threatblock_dir"
# List of URLs
urls=(
"https://gist.githubusercontent.com/ckuethe/f71185f604be9cde370e702aa179fc2e/raw/53fe52046836ac3009e9505b7b8b8b5de42d84e3/doh-blocklist.txt"
"https://raw.githubusercontent.com/hagezi/dns-blocklists/main/ips/doh.txt"
"https://blocklistproject.github.io/Lists/abuse.txt"
"https://blocklistproject.github.io/Lists/ads.txt"
"https://blocklistproject.github.io/Lists/crypto.txt"
"https://blocklistproject.github.io/Lists/drugs.txt"
"https://blocklistproject.github.io/Lists/facebook.txt"
"https://blocklistproject.github.io/Lists/fraud.txt"
"https://blocklistproject.github.io/Lists/gambling.txt"
"https://blocklistproject.github.io/Lists/malware.txt"
"https://blocklistproject.github.io/Lists/phishing.txt"
"https://blocklistproject.github.io/Lists/piracy.txt"
"https://blocklistproject.github.io/Lists/porn.txt"
"https://blocklistproject.github.io/Lists/ransomware.txt"
"https://blocklistproject.github.io/Lists/redirect.txt"
"https://blocklistproject.github.io/Lists/scam.txt"
"https://blocklistproject.github.io/Lists/tiktok.txt"
"https://blocklistproject.github.io/Lists/torrent.txt"
"https://blocklistproject.github.io/Lists/tracking.txt"
"https://blocklistproject.github.io/Lists/smart-tv.txt"
"https://blocklistproject.github.io/Lists/whatsapp.txt"
"https://blocklistproject.github.io/Lists/vaping.txt"
"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/light.txt"
"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/multi.txt"
"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/pro.txt"
"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/pro.plus.txt"
"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/ultimate.txt"
"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/tif.txt"
"https://nickoppen.github.io/pihole-blocklists/blocklist-activision.txt"
"https://nickoppen.github.io/pihole-blocklists/blocklist-blizzard.txt"
"https://nickoppen.github.io/pihole-blocklists/blocklist-ea.txt"
"https://nickoppen.github.io/pihole-blocklists/blocklist-nordvpn.txt"
"https://nickoppen.github.io/pihole-blocklists/blocklist-reddit.txt"
"https://nickoppen.github.io/pihole-blocklists/blocklist-signal.txt"
"https://nickoppen.github.io/pihole-blocklists/blocklist-snapchat.txt"
"https://nickoppen.github.io/pihole-blocklists/blocklist-steam.txt"
"https://nickoppen.github.io/pihole-blocklists/blocklist-surfshark.txt"
"https://nickoppen.github.io/pihole-blocklists/blocklist-telegram.txt"
"https://nickoppen.github.io/pihole-blocklists/blocklist-tinder.txt"
"https://raw.githubusercontent.com/crpietschmann/pi-hole-blocklist/main/blocklist-social-all.txt"
"https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/dnsmasq/doh-vpn-proxy-bypass.txt"
)
# Loop through URLs and download files
for url in "${urls[@]}"; do
filename=$(basename "$url")
filename="${filename%.txt}" # Remove .txt extension
curl -s "$url" -o "$threatblock_dir/$filename"
echo "Downloaded $filename"
done
# Cleanups
curl "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/porn/hosts" -o "$threatblock_dir/sbporn"
curl "https://raw.githubusercontent.com/StevenBlack/hosts/master/data/add.Risk/hosts" -o "$threatblock_dir/sbsecurity"
curl "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts" -o "$threatblock_dir/sbdefault"
kill $(cat /var/run/bonding/dnsmasq.pid)
/usr/local/sbin/extra-dnsgate.sh /etc/extra/extra-dnsgate.conf
This script can be scheduled as a daily run.
The final piece is to configure the custom DNSMASQ file with the filters. This is done as follows:
addn-hosts=/etc/extra/MASQF/tiktok
addn-hosts=/etc/extra/MASQF/torrent
conf-file=/etc/extra/MASQF/doh-vpn-proxy-bypass
The above filters out tiktok and torrent sites. The last line prevents VPN and DNS bypass.
Ronald Bartels ensures that Internet inhabiting things are connected reliably online at Fusion Broadband South Africa - the leading specialized SD-WAN provider in South Africa. Learn more about the best SD-WAN in the world: 👉 Contact Fusion
