DNS management
The DNS Settings section has several subsections: Zones, Resolvers, Subnets, Rule sets, and Logs history. Everything in this part of the administration portal relates to DNS configuration for use with the DNS PATROL application.
Zones
A zone is a logical network that the portal needs for resolver configuration.
After clicking on the Zones tab, a table appears displaying all created zones.
Each zone contains the following parameters:
| Item | Description |
|---|---|
| Name | Name of the zone |
| Gateway IPv4 | A device (router) with an IPv4 address that serves as a link between the local network and the external world |
| Gateway IPv6 | A device (router) with an IPv6 address that serves as a link between the local network and the external world |
| DoH URL | Address of the DNS over HTTPS server |
| External Zone | Indicates whether this is an external zone |
A new zone can be created using the Add Zone button in the top right corner of the administration portal. Then you need to fill in the individual parameters and click Save.
After clicking on a specific zone in the table, its details appear, and it can be further edited using the gear icon button in the top right corner of the screen.
Besides the parameters entered when the zone was created, the details show RPZ count (how many RPZ files apply in the zone based on the rule sets used on its subnets) and Config last published at (when the zone configuration was last successfully published to the resolvers).
On this page, in the Subnet section, you can see the specific subnet to which the given zone belongs. In the Resolvers section, there is a table with resolvers belonging to this zone.
Resolvers
After clicking the Resolvers section, a table appears displaying all created resolvers.
A resolver is a program that responds to DNS queries and determines where the administration portal uploads configuration files.
Each resolver contains the following parameters:
| Item | Description |
|---|---|
| Hostname | A unique name assigned to each device in the network, replacing numeric IP addresses |
| Zone | The zone in which the resolver is located |
| IPv4 addresses | IPv4 addresses of the individual devices in the network |
| IPv6 addresses | IPv6 addresses of the individual devices in the network |
| Master Resolver | Indicates whether this is the resolver to which queries are primarily sent |
| Status | Resolver status, whether it shows any errors |
| Last checked | Date and time when the resolver was last checked |
After clicking on an individual resolver in the table, its details are displayed. In the Zone section, you can see which zone the resolver belongs to.
Subnets
In the Subnets section, you will find a table with created parent networks and child subnets.
Each subnet contains the following parameters:
| Item | Description |
|---|---|
| Name | Name of the subnet |
| IPv4 ranges | Range of IPv4 addresses in this subnet |
| IPv6 ranges | Range of IPv6 addresses in this subnet |
| Parent subnet | The subnet that is the parent of the current one |
A new subnet can be created using the Add Subnet button in the top right corner of the administration portal. Then you need to fill in the parameters and click Save. Multiple IPv4 or IPv6 ranges can be added to a single subnet.
Below the subnet table, there is a graphical structure of the networks, which can be edited using the Change subnet structure button on the right side of the screen.
You can also adjust how graphs are displayed using the Graph Layout button.
To add another subnet within the structure, click the + button next to the desired subnet.
After clicking on a subnet in the table or graph, you will see its details, which can be further edited. Here you will find information about the subnet, including the Applied RPZ count (how many RPZ files apply to this subnet and its child subnets), its parent subnet, and a list of child subnets.
You will also find a table of rule sets applied to the subnet. You can assign rule sets using the pencil icon above the table on the right side of the screen. From the list of rule sets, choose which one you want to use and set its state using the slider:
- Enable: the rule set is applied to the subnet, domains from the list are blocked or allowed according to the rule set type (Blocklist or Whitelist)
- Audit: domains from the rule set are monitored and logged only, without being blocked or allowed
- Disable: the rule set is not applied to the subnet
- Then click
Save.
The opened subnet also contains a Realtime logs section, where you can monitor what was blocked and check access to domains from the rule set configured as Audit.
Real-time logs
An example how to read the data in logs.
| Response code | Policy action | Policy rule | Meaning |
|---|---|---|---|
| NXDOMAIN | - | - | domain is not accessible |
| NXDOMAIN | BLOCK | - | domain blocked by the resolver based on internal resolver rules |
| NXDOMAIN | BLOCK | modul201 | domain blocked by the resolver based on given Rule set modul201 set up to Block |
Rule Sets
Rule sets contain individual lists of domains that can be used as:
- Blocklist: these domains will be blocked (red color)
- Whitelist: these domains are allowed (green color)
Each rule set contains the following parameters:
| Item | Description |
|---|---|
| Name | Name of the rule set |
| Description | Purpose of the domain list associated with this rule |
| Domains | List of domains covered by this rule |
| Rule set type | Is the rule set Blocklist or Whitelist |
| Source | Origin of the rule set: internal for rule sets created and edited in the portal, or the name of the feed the rule set was imported from (e.g. external feeds picked up by the RPZ monitor) |
A new rule set can be created using the Add rule set button in the top right corner of the administration portal. Then fill in the parameters and click Save. The rule set name must be alphanumeric with dashes only, no spaces or other special characters, and at least two characters long.
After clicking on a rule set in the table, more information about it is displayed.
The Filtered Domains table, a list of domains affected by this rule set, is only shown for rule sets with source internal. Imported rule sets are read-only and their domain list is managed by the import feed. For internal rule sets, individual domain patterns can be edited inline in the table, new domains can be added through the table’s add-row input, and selected domains can be deleted with the trash bin button. The Expand from CSV button uploads a file of domains that will be added to the domain list. The Replace from CSV button replaces all domains in this set with domains from the uploaded file. The Export to CSV button downloads the domain list as a CSV file.
In the Used on Subnets section, you can see which subnets use this rule set.
On this page, it is also possible to edit the rule set’s name, description, and type using the gear icon in the top right corner of the administration portal, or delete it using the red trash bin icon. The lock icon opens user permissions for the rule set.
Sorting: For better clarity, rule sets can be sorted by column by clicking on the column header. This works the same way in all other tables on all columns.