GraceDNSNetwork rules#
Network rules work with IP addresses instead of domain names. They do two independent jobs: identifying which network a query comes from, and blocking answers that point into address ranges you choose.
Linked client ranges: map networks to a configuration#
Classic DNS carries no configuration id, so for plain port-53 setups you link your network's public IP address or range (in CIDR form, like 203.0.113.0/24) to a configuration. Every query arriving from that range gets that configuration's rules. This is how an office, a school building or a home router gets filtered without touching every device; see router setup.
You can link several ranges to one configuration, and different ranges to different configurations. When ranges nest, the most specific one wins, so a branch office inside the company range can have its own rules. Queries from unlinked addresses fall back to the neutral default configuration. Ranges are IPv4 today.
If your public IP changes (common on home connections), update the linked range; until you do, your queries are answered unfiltered rather than with someone else's rules. Encrypted DNS with your id in the hostname or URL avoids the problem entirely.
Blocked answer ranges: refuse answers by destination#
The second kind of rule looks at where an answer points. Add a blocked answer range and any lookup whose result lands inside it is refused, whatever the domain. Useful for cutting off a hosting range that keeps serving abuse, or enforcing "nothing on this network talks to that address space" without enumerating domains. IPv4 ranges today; your allowlist does not override these blocks, since they are address-based on purpose.
Back to features.