# Install Bind9 Server Recursion  & RPZ Ubuntu 20.04

## Install BIND9

The first thing you need to do is to update the package list and to install BIND9.

```bash
sudo apt update 
sudo apt install bind9
```

## BIND9 configuration

```bash
cd /etc/bind/
```

The main configuration file is `named.conf.options`

```bash
sudo nano named.conf.options
```

```bash
acl LAN {
        192.168.1.0/24;
};

options {
        dnssec-validation auto;

        listen-on-v6 { any; };

        directory "/var/cache/bind"; // default directory
        max-cache-size 10m;
        allow-query { localhost; LAN;}; // allow queries from localhost and 192.168.1.0-192.168.1.255

        forwarders {
                1.1.1.1;
                1.0.0.1;
        }; // use CloudFlare 1.1.1.1 DNS as a forwarder

        recursion yes;  // allow recursive queries
        auth-nxdomain no;    # conform to RFC1035
        allow-recursion {
                LAN;
        };
};
```

## Create RPZ ([Response Policy Zones](https://www.isc.org/rpz/))

create rpz database.

```bash
cp db.local db.blocked
sudo nano db.blocked
```

```bash
;
; BIND data file for local loopback interface
;
$TTL    604800
@       IN      SOA     blocked.local. root.blocked.local. (
                         2309111627     ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      blocked.local.
@       IN      A       192.168.1.222
xxx.xxx IN    CNAME     @ # blocked domain
```

register database to zone

```bash
sudo nano named.conf.local
```

```bash
zone "blocked" {
    type master;
    file "/etc/bind/db.blocked";
    allow-query {any;};
    allow-update {none;};
};

; === https://github.com/andrizan/partial-output ===
zone "trust-aa" {
    type master;
    file "/etc/bind/db.trust-aa";
    allow-query {any;};
    allow-update {none;};
};

zone "trust-ab" {
    type master;
    file "/etc/bind/db.trust-ab";
    allow-query {any;};
    allow-update {none;};
};

zone "adultaa" {
    type master;
    file "/etc/bind/db.adultaa";
    allow-query {any;};
    allow-update {none;};
};

zone "adultab" {
    type master;
    file "/etc/bind/db.adultab";
    allow-query {any;};
    allow-update {none;};
};

zone "adultac" {
    type master;
    file "/etc/bind/db.adultac";
    allow-query {any;};
    allow-update {none;};
};

zone "adultad" {
    type master;
    file "/etc/bind/db.adultad";
    allow-query {any;};
    allow-update {none;};
};

zone "adultae" {
    type master;
    file "/etc/bind/db.adultae";
    allow-query {any;};
    allow-update {none;};
};
zone "adultaf" {
    type master;
    file "/etc/bind/db.adultaf";
    allow-query {any;};
    allow-update {none;};
};

zone "adultag" {
    type master;
    file "/etc/bind/db.adultag";
    allow-query {any;};
    allow-update {none;};
};

zone "malware" {
    type master;
    file "/etc/bind/db.malware";
    allow-query {any;};
    allow-update {none;};
};
```

Register the zone to the response policy.

```bash
sudo nano named.conf.options
```

```bash
acl LAN {
        192.168.1.0/24;
};

# accept all connection
# acl all {
#        0.0.0.0/0;
# };

options {
        dnssec-validation auto;

        listen-on-v6 { any; };

        directory "/var/cache/bind"; // default directory
        max-cache-size 10m;
        cleaning-interval 480; // clean cache every 8 hours
        allow-query { localhost; LAN;}; // allow queries from localhost and 192.168.1.0-192.168.1.255
        response-policy {
                zone "blocked";
                zone "trust-aa";
                zone "trust-ab";
                zone "adultaa";
                zone "adultab";
                zone "adultac";
                zone "adultad";
                zone "adultae";
                zone "adultaf";
                zone "adultag";
#               zone "malware";
        } recursive-only no max-policy-ttl 60 break-dnssec no qname-wait-recurse no;

# disable 'check-names'
#check-names master ignore;
#check-names slave ignore;
#check-names response ignore;

        forwarders {
                1.1.1.1;
                1.0.0.1;
        }; // use CloudFlare 1.1.1.1 DNS as a forwarder

        recursion yes;  // allow recursive queries
        auth-nxdomain no;    # conform to RFC1035
        allow-recursion {
                LAN;
        };
};
```

# Docker

[https://www.youtube.com/watch?v=syzwLwE3Xq4](https://www.youtube.com/watch?v=syzwLwE3Xq4)

# Ref

* [https://serverspace.io/support/help/configure-bind9-dns-server-on-ubuntu/](https://serverspace.io/support/help/configure-bind9-dns-server-on-ubuntu/)
    
* [https://github.com/andrizan/partial-output](https://github.com/andrizan/partial-output)
    
* [https://www.isc.org/bind/](https://www.isc.org/bind/)
    
* [https://www.isc.org/rpz/](https://www.isc.org/rpz/)