Overriding external domains DNS Bind9’s Response Policy Zone on your pfSense

Last Updated on March 18, 2023 by Thiago Crepaldi

On a previous post, we’ve discussed how to use Bind9 on your pfSense in a way that external names were forwarded to name servers while internal names were statically resolved by Bind. In this post, we are going to discuss how to override the IPs returned by external name servers with IPs of our choosing. As an example, assume you want to make www.disney.com to resolve to 192.168.0.666!

You could do this by changing the hosts file on each machine, but this would hardly scale. Since BIND 9.8.1, the concept of Response Policy Zone was created for this purpose and we are going to demonstrate how it works.

First, I am assuming you have a working bind9 on your pfSense. Next, go to Service >> BIND DNS Server >> Zones and click on Add:

• Zone
  • Domain Zone Configuration
    • Disable this zone: Unchecked
    • Zone name: response-policy-zone
    • Description: Trusted Forward zone for public overridden DNS records
    • Zone Type: Master
    • View: Trusted-View
    • Reverse zone: Unchecked
    • IPv6 Reverse Zone: Unchecked
    • Response Policy Zone: Checked
    • Custom option: leave blank
  • DNSSEC
    • Inline signing: Unchecked
  • Master Zone Configuration
    • TTL: 86400
    • Nameserver: localhost
    • Base domain IP: 127.0.0.1
    • Mail Admin Zone: root@localhost or a real email
    • Serial: 1 or something like YYYYMMDDxx (e.g. 2023031701)
    • Refresh: 1d
    • Retry: 2h
    • Expire: 4w
    • Minimum: 1h
    • allow-update: None
    • Enable update-policy: Unchecked
    • allow-query: Trusted-ACL
    • allow-transfer: None
  • Zone Domain Records:
    • Add an entry
      • Record: disney.com
      • Type: A
      • Priority: leave blank
      • Alias or IP address: 192.168.0.666
    • Register DHCP Static Mappings: Unchecked
  • Custom Zone Domain Records:
    • leave empty

Click on Save and you are done. If you need more overrides, just add them to the Zone Domain Records section above

Have fun!