public-dns-allowlist Log Parser by crowdsecurity | CrowdSec Hub

public-dns-allowlist

Log parser

By: crowdsecurity
Version: 0.1

Allow events from public DNS servers

Install with a top-level collection

6 collections include it

sudo cscli collections install crowdsecurity/openbsd

Installs 6 parsers and 6 scenarios, via Web Crawlers - Whitelist.

View OpenBSD →

Installation

sudo cscli parsers install crowdsecurity/public-dns-allowlist

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

parsers/s02-enrich/crowdsecurity/public-dns-allowlist.yaml· 70 linesGitHub

1name: crowdsecurity/public-dns-allowlist
2description: "Allow events from public DNS servers"
3whitelist:
4  reason: "public DNS server"
5  ip:
6    # cloudflare
7    - 1.1.1.1
8    - 1.0.0.1
9    - "2606:4700:4700::1111"
10    - "2606:4700:4700::1001"
11    # google
12    - 8.8.8.8
13    - 8.8.4.4
14    - "2001:4860:4860::8888"
15    - "2001:4860:4860::8844"
16    #quad9
17    - 9.9.9.9
18    - 149.112.112.112
19    - "2620:fe::fe"
20    - "2620:fe::9"
21    - 9.9.9.11
22    - 149.112.112.11
23    - "2620:fe::11"
24    - "2620:fe::fe:11"
25    - 9.9.9.10
26    - 149.112.112.10
27    - "2620:fe::10"
28    - "2620:fe::fe:10"
29    # cleanbrowsing
30    - 185.228.168.168
31    - 185.228.169.168
32    - "2a0d:2a00:1::"
33    - "2a0d:2a00:2::"
34    # alternate DNS
35    - 76.76.19.19
36    - 76.223.122.150
37    - "2602:fcbc::ad"
38    - "2602:fcbc:2::ad"
39    # adguard
40    - 94.140.14.14

Installed on

Know where it runs

Documentation

Public DNS Allowlist

This allowlist contains public DNS resolver IPs.

Providers currently in the list:

Cloudflare
Google
Quad9
CleanBrowsing
AlternateDNS
Adguard
OpenDNS
Control D