Protect Your Network at the DNS Level

This script syncs allowed IPs to iptables and downloads blocklists from your FirewallDNS account. Run as a systemd service.

#!/bin/bash
# FirewallDNS Server Client
# This script runs on your DNS server to sync with FirewallDNS

FIREWALLDNS_API="https://api.firewalldns.com/v1"
API_KEY="your-api-key-here"

# Function to sync allowed IPs
sync_iptables() {
  echo "Fetching allowed IPs from FirewallDNS..."
  
  # Get list of allowed IPs from API
  ALLOWED_IPS=$(curl -s -H "Authorization: Bearer $API_KEY" \
    "$FIREWALLDNS_API/allowed-ips")
  
  # Clear existing FirewallDNS rules
  iptables -D INPUT -p udp --dport 53 -j FIREWALLDNS 2>/dev/null
  iptables -F FIREWALLDNS 2>/dev/null
  iptables -X FIREWALLDNS 2>/dev/null
  
  # Create new chain
  iptables -N FIREWALLDNS
  
  # Add allowed IPs
  for ip in $ALLOWED_IPS; do
    iptables -A FIREWALLDNS -s $ip -j ACCEPT
    echo "Allowed: $ip"
  done
  
  # Drop all other DNS traffic
  iptables -A FIREWALLDNS -j DROP
  
  # Link to INPUT chain
  iptables -A INPUT -p udp --dport 53 -j FIREWALLDNS
  
  echo "iptables rules updated successfully"
}

# Function to sync DNS blocking rules
sync_blocklists() {
  echo "Syncing blocklists from FirewallDNS..."
  
  # Fetch user-specific blocklists
  curl -s -H "Authorization: Bearer $API_KEY" \
    "$FIREWALLDNS_API/blocklists" > /etc/firewalldns/blocklists.txt
    
  # Reload DNS server (example for dnsmasq)
  systemctl reload dnsmasq
  
  echo "Blocklists synced successfully"
}

# Main sync loop
while true; do
  sync_iptables
  sync_blocklists
  sleep 60  # Sync every minute
done

Example dnsmasq configuration for use with FirewallDNS. Logs all queries and loads blocklists from the synced file.

# /etc/dnsmasq.d/firewalldns.conf
# FirewallDNS dnsmasq configuration

# Log all DNS queries
log-queries
log-facility=/var/log/firewalldns/queries.log

# Load blocklists
conf-file=/etc/firewalldns/blocklists.txt

# Forward to upstream DNS if not blocked
server=8.8.8.8
server=8.8.4.4

# Listen on all interfaces
interface=eth0
bind-interfaces

# Cache settings
cache-size=10000
neg-ttl=3600

Forwards DNS query logs to FirewallDNS in real-time. This enables the dashboard analytics and threat detection features.

#!/bin/bash
# Send DNS logs to FirewallDNS API

FIREWALLDNS_API="https://api.firewalldns.com/v1"
API_KEY="your-api-key-here"
LOG_FILE="/var/log/firewalldns/queries.log"

tail -F $LOG_FILE | while read line; do
  # Parse dnsmasq log format
  DOMAIN=$(echo $line | grep -oP 'query\[\w+\] \K[^ ]+')
  QUERY_TYPE=$(echo $line | grep -oP 'query\[\K\w+')
  CLIENT_IP=$(echo $line | grep -oP 'from \K[0-9.]+')
  
  if [ -n "$DOMAIN" ]; then
    # Send to API
    curl -s -X POST -H "Authorization: Bearer $API_KEY" \
      -H "Content-Type: application/json" \
      -d "{\"domain\": \"$DOMAIN\", \"query_type\": \"$QUERY_TYPE\", \"source_ip\": \"$CLIENT_IP\"}" \
      "$FIREWALLDNS_API/logs"
  fi
done