Due to the lack of IPv6 connectivity by my local ISP, I am using IPv6 tunnel service from Hurricane Electric. But since Netflix introduced their proxy filtering feature HE’s service is banned. Because of this I needed to force network devices to use good old IPv4 for any Netflix related traffic without giving up on IPv6 completely.
Turris Omnia is by default using Knot Resolver as DNS server and I wasn't able to find any quick way how to create a policy that would filter only AAAA records for the selected domain so as a workaround I started BIND9 instance that can do that easily and forwarded netflix.com domain to that BIND instance from Kresd.
Install the server
opkg install bind-rndc bind-server bind-server-filter-aaaa
Replace /etc/bind/named.conf with this minimal configuration that filters AAAA:
plugin query "/usr/lib/bind/filter-aaaa.so" {
filter-aaaa-on-v4 yes;
filter-aaaa-on-v6 yes;
};
options {
directory "/tmp";
forwarders {
127.0.0.1;
};
forward only;
auth-nxdomain no;
// run bind on the local loopback interface only and listen on port 2053
listen-on port 2053 { 127.0.0.1; };
listen-on-v6 port 2053 { ::1; };
allow-query { any; }; // If running a on a public IP
allow-recursion { any; }; // If running a on a public IP
allow-query-cache { any; }; // If running a on a public IP
};
Enable BIND9 at boot
/etc/init.d/named enable
And start it
/etc/init.d/named start
</code>
Just create netflix.conf file in /etc/kresd directory with this content:
local netflix_rule = policy.add(policy.suffix(policy.FORWARD('127.0.0.1@2053'), policy.todnames({'netflix.com'})))
policy.del(netflix_rule.id)
table.insert(policy. Rules, 1, netflix_rule)
In /etc/config/resolver configuration file at kresd section add new line that will load /etc/kresd/netflix.conf config file like here:
config resolver 'kresd'
option include_config '/etc/kresd/netflix.conf'
And now just restart kresd to use new configuration
/etc/init.d/kresd restart
BIND output
dig @localhost -p 2053 netflix.com AAAA
Kresd output
dig @localhost -p 53 netflix.com AAAA
Google DNS output
dig @8.8.8.8 -p 53 netflix.com AAAA
If everything works correctly in first two outputs you should not see any AAAA records.
Happy Netflix watching while using IPv6 elsewhere!