DNS filtering/pass-through

[strictlymike]

Users would like to be able to allow the DNS listener to pass selected requests through to an actual DNS server.

Regular expressions stand out as a way for users to specify what requests to pass through without having to revisit this if requirements become more complex.

It would be worthwhile to allow users to also specify whether the default behavior will be to pass through vs. simulate.

Thanks to @dzzie and @garsim for pointing out the utility of such a feature. Please feel free to add a follow-on comment if you would like to elaborate on the specification above.

[dzzie]

i ended up with a config file that has 4 sections for white/black listed processes and domains using fnmatch for wildcard support. here is what I implemented for reference, feel free to rip anything you want:

https://github.com/dzzie/dnsblock/blob/master/dnsblock.py#L93

as an aside, on Win10 i ended up deleting the dnscache service from the registry now I can see the actual calling process making the request instead of everything just showing the dnscache service pid. not sure if fakenet already worked around that in another way

[strictlymike]

Thanks! FakeNet-NG does have a setting for stopping the DNS resolver so that the originating PID is visible in log output instead of some svchost.exe instance (the setting name escapes me at the moment).

Thanks for the code sample, we will scrape as needed! ;-)