71 lines
1.7 KiB
YAML
71 lines
1.7 KiB
YAML
---
|
|
# Netblocks permitted to use the resolvers (plain DNS access-control and DoH).
|
|
# Single source of truth: consumed by unbound.conf.j2 and Caddyfile-resolver.j2.
|
|
resolver_allowed_netblocks:
|
|
- 127.0.0.0/8
|
|
- 204.110.188.0/22
|
|
- 10.0.0.0/8
|
|
- 172.1.0.0/15
|
|
- 100.64.0.0/10
|
|
- 192.168.0.0/16
|
|
- ::1
|
|
- 2606:1c80::/32
|
|
|
|
# Firewalld trusted subnets (consumed by firewall role).
|
|
# Must mirror resolver_allowed_netblocks to avoid IP-level drops before
|
|
# unbound/Caddy ever see the traffic.
|
|
firewall_trusted_subnets:
|
|
- subnet: 100.64.0.0/10
|
|
comment: Tailscale
|
|
- subnet: 204.110.188.0/22
|
|
comment: VNTX
|
|
- subnet: 10.0.0.0/8
|
|
comment: Internal
|
|
- subnet: 192.168.0.0/16
|
|
comment: Internal
|
|
- subnet: 172.1.0.0/15
|
|
comment: VNTX
|
|
|
|
# Domains returned as NXDOMAIN (blocklist). Covers the name and all subdomains.
|
|
# Consumed by unbound.conf.j2 via local-zone ... always_nxdomain.
|
|
resolver_blocked_domains:
|
|
- proxyjs.brdtnet.com
|
|
- proxyjs.luminatinet.com
|
|
- proxyjs.bright-sdk.com
|
|
- clientsdk.bright-sdk.com
|
|
- clientsdk.brdtnet.com
|
|
|
|
firewall_allow_rules:
|
|
- port: 53
|
|
proto: udp
|
|
comment: DNS
|
|
- port: 53
|
|
proto: tcp
|
|
comment: DNS
|
|
- port: 80
|
|
proto: tcp
|
|
comment: HTTP (Let's Encrypt HTTP-01 challenge)
|
|
sources:
|
|
- 100.64.0.0/10
|
|
- 204.110.188.0/22
|
|
- 10.0.0.0/8
|
|
- 192.168.0.0/16
|
|
- 172.1.0.0/15
|
|
ipv6_sources:
|
|
- "::1"
|
|
- 2606:1c80::/32
|
|
- port: 443
|
|
proto: tcp
|
|
comment: HTTPS (DNS-over-HTTPS)
|
|
sources:
|
|
- 100.64.0.0/10
|
|
- 204.110.188.0/22
|
|
- 10.0.0.0/8
|
|
- 192.168.0.0/16
|
|
- 172.1.0.0/15
|
|
ipv6_sources:
|
|
- "::1"
|
|
- 2606:1c80::/32
|
|
|
|
# Use the shared resolver Caddyfile instead of the global default.
|
|
caddy_template: Caddyfile-resolver.j2
|