{"id":25883097,"url":"https://github.com/o-x-l/nftables_addon_dns","last_synced_at":"2025-08-11T09:09:11.683Z","repository":{"id":189309559,"uuid":"680432312","full_name":"O-X-L/nftables_addon_dns","owner":"O-X-L","description":"NFTables Addon for DNS-Resolved variables","archived":false,"fork":false,"pushed_at":"2024-12-29T12:03:52.000Z","size":44,"stargazers_count":8,"open_issues_count":0,"forks_count":2,"subscribers_count":3,"default_branch":"latest","last_synced_at":"2025-04-05T07:51:13.594Z","etag":null,"topics":["dns","firewall","network","networking","nftables","nftables-sets"],"latest_commit_sha":null,"homepage":"https://docs.o-x-l.com/firewall/nftables.html","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/O-X-L.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-08-19T08:09:47.000Z","updated_at":"2025-01-12T19:42:19.000Z","dependencies_parsed_at":"2025-03-02T16:31:20.709Z","dependency_job_id":"c953d4e3-f8e0-4634-9556-45598819174b","html_url":"https://github.com/O-X-L/nftables_addon_dns","commit_stats":null,"previous_names":["superstes/nftables_addon_dns","o-x-l/nftables_addon_dns"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/O-X-L/nftables_addon_dns","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/O-X-L%2Fnftables_addon_dns","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/O-X-L%2Fnftables_addon_dns/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/O-X-L%2Fnftables_addon_dns/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/O-X-L%2Fnftables_addon_dns/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/O-X-L","download_url":"https://codeload.github.com/O-X-L/nftables_addon_dns/tar.gz/refs/heads/latest","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/O-X-L%2Fnftables_addon_dns/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":269857485,"owners_count":24486395,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-11T02:00:10.019Z","response_time":75,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dns","firewall","network","networking","nftables","nftables-sets"],"created_at":"2025-03-02T16:31:13.738Z","updated_at":"2025-08-11T09:09:11.658Z","avatar_url":"https://github.com/O-X-L.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# NFTables Addon - DNS Resolution\n\nNFTables lacks some functionality, that is commonly used in firewalling.\n\nHaving variables that hold the IPs of some DNS-record is one of those.\n\nNFTables CAN resolve DNS-records - but will throw an error if the record resolves to more than one IP.. (`Error: Hostname resolves to multiple addresses`)\n\nLinks: [NFTables Documentation](https://docs.o-x-l.com/firewall/nftables.html) |\n[Video in German](https://www.youtube.com/watch?v=bTsElH5FjS8) |\n[Addon for IP-Lists](https://github.com/O-X-L/nftables_addon_iplist) |\n[Addon for Connection-Failover](https://github.com/O-X-L/nftables_addon_failover)\n\n----\n\n## Install\n\n* Create directories:\n\n   ```bash\n   mkdir -p /var/local/lib/nftables_addons /etc/nftables.d/addons/\n   ```\n\n* Add the script-files:\n\n   * [util.py](https://github.com/O-X-L/nftables_addon_dns/blob/latest/lib/util.py)\n   * [dns.py](https://github.com/O-X-L/nftables_addon_dns/blob/latest/lib/dns.py)\n   * [dns_resolver.py](https://github.com/O-X-L/nftables_addon_dns/blob/latest/lib/dns_resolver.py)\n\n* Add the config file:\n\n   `/etc/nftables.d/addons/dns.json`\n\n* Optional: Create a service user\n\n   * Add sudoers privileges\n   * Allow to read lib-dir\n   * Allow to write to addons-config-dir\n\n* Add cron or systemd-timer to execute the script on a schedule: `python3 /var/local/lib/nftables_addons/dns.py`\n\n* Test it and verify it's working as expected\n\n----\n\n## Result\n\n```text\ncat /etc/nftables.d/addons/dns.nft\n\u003e # Auto-Generated config - DO NOT EDIT MANUALLY!\n\u003e \n\u003e define site_github_v4 = { 140.82.121.3, 140.82.121.10 }\n\u003e define site_github_v6 = { :: }\n\u003e define repo_debian_v4 = { 151.101.86.132 }\n\u003e define repo_debian_v6 = { 2a04:4e42:14::644 }\n\u003e define ntp_pool_v4 = { 158.43.128.33, 178.62.250.107, 194.58.207.20, 37.252.127.156 }\n\u003e define ntp_pool_v6 = { :: }\n```\n\n----\n\n## How does it work?\n\n1. A configuration file needs to be created:\n\n    `/etc/nftables.d/addons/dns.json`\n\n    ```json\n    {\n      \"dns\": {\n        \"site_github\": [\"github.com\", \"codeload.github.com\"],\n        \"repo_debian\": \"deb.debian.org\",\n        \"ntp_pool\": \"europe.pool.ntp.org\"\n      }\n    }\n    ```\n\n    **Note**: If your variable ends in `_1` it will only contain **ONE** IP address! This can be useful if you need a DNAT target.\n\n\n2. The script is executed\n\n    `python3 /var/local/lib/nftables_addons/dns.py`\n\n  * It will load the configuration\n  * Resolve IPv4 and IPv6 (_if enabled_) for all configured variables\n  * If it was unable to resolve some record - a placeholder-value will be set:\n\n    IPv4: `0.0.0.0`\n\n    IPv6: `::`\n\n  * The new addon-config is written to `/tmp/nftables_dns.nft`\n  * Its md5-hash is compared to the existing config to check if it changed\n\n  * **If it has changed**:\n    * **Config validation** is done:\n\n      * An include-file is written to `/tmp/nftables_main.nft`:\n\n        ```nft\n        include /tmp/nftables_dns.nft\n        # including all other adoon configs\n        include /etc/nftables.d/addons/other_addon1.nft\n        include /etc/nftables.d/addons/other_addon2.nft\n        # include other main configs\n        include /etc/nftables.d/*.nft\n        ```\n\n      * This include-file is validated:\n\n        `sudo nft -cf /tmp/nftables_main.nft`\n\n    * The new config is written to `/etc/nftables.d/addons/dns.nft`\n    * The actual config is validated: `sudo nft -cf /etc/nftables.conf`\n    * NFTables is reloaded: `sudo systemctl reload nftables.service`\n\n\n3. You will have to include the addon-config in your main-config file `/etc/nftables.conf`:\n\n    ```\n    ...\n    include \"/etc/nftables.d/addons/*.nft\"\n    ...\n    ```\n\n----\n\n## Privileges\n\nIf the script should be run as non-root user - you will need to add a sudoers.d file to add the needed privileges:\n\n```text\nCmnd_Alias NFTABLES_ADDON = \\\n  /usr/bin/systemctl reload nftables.service,\n  /usr/sbin/nft -cf *\n\nservice_user ALL=(ALL) NOPASSWD: NFTABLES_ADDON\n```\n\nYou may not change the owner of the addon-files as the script will not be able to overwrite them.\n\n----\n\n## Safety\n\nAs explained above - there is a config-validation process to ensure the addon will not supply a bad config and lead to a failed nftables reload/restart.\n\nIf you want to be even safer - you can add a config-validation inside the `nftables.service`:\n\n```text\n# /etc/systemd/system/nftables.service.d/override.conf\n[Service]\n# catch errors at start\nExecStartPre=/usr/sbin/nft -cf /etc/nftables.conf\n\n# catch errors at reload\nExecReload=\nExecReload=/usr/sbin/nft -cf /etc/nftables.conf\nExecReload=/usr/sbin/nft -f /etc/nftables.conf\n\n# catch errors at restart\nExecStop=\nExecStop=/usr/sbin/nft -cf /etc/nftables.conf\nExecStop=/usr/sbin/nft flush ruleset\n\nRestart=on-failure\nRestartSec=5s\n```\n\nThis will catch and log config-errors before doing a reload/restart.\n\n----\n\n## Scheduling\n\nYou can either:\n\n* Add a Systemd Timer: [example](https://github.com/ansibleguy/addons_nftables/tree/latest/templates/etc/systemd/system)\n* Add a cron job\n\n----\n\n## Ansible\n\nHere you can find an Ansible Role to manage NFTables Addons:\n\n* [ansibleguy.addons_nftables](https://github.com/ansibleguy/addons_nftables)\n* [examples](https://github.com/ansibleguy/addons_nftables/blob/latest/Example.md)\n\n----\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fo-x-l%2Fnftables_addon_dns","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fo-x-l%2Fnftables_addon_dns","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fo-x-l%2Fnftables_addon_dns/lists"}