Move all DNS proxy related rules into single nftables table. - Githubissues

metal-stack / firewall-controller

A kubernetes controller running on bare-metal firewalls, creating nftables rules, configures suricata, collects network metrics

MIT License

49 stars 4 forks source link

Move all DNS proxy related rules into single nftables table. #179

Open Gerrit91 opened 7 months ago

Gerrit91 commented 7 months ago

Have no idea if this is gonna work, but it would bring the following improvements:

Only configured DNS server considered by proxy, no public servers used anymore if desired
Potentially more than one DNS server can be configured for DNS proxy
Fixes alternative DNS port setting not working in current implementation
Less responsibility of metal-networker for firewall-controller features

Still missing in this refactoring:

[ ] IPv6 compatibility
[ ] Filter on snat rules (?)