EonaCat.Blocky 4.6.6

Blocky

Blocking domains the way you want it Blocky is the web administration interface and host application for EonaCat DNS. It provides domain blocking, allowlisting, DNS configuration, live statistics, logs, and server management from a browser.

Copyright EonaCat (Jeroen Saey) 2017-2026 https://blocky.eonacat.com

Features

• DNS blocklists and allowlists with category support
• Recursive resolution through configured IPv4, IPv6, or DNS-over-HTTPS forwarders
• Authoritative zone data from the bundled masterFile.txt
• DNSSEC signing for local authoritative answers
• IPv4 and IPv6 DNS listeners with UDP and TCP fallback
• Optional multicast DNS support
• Cache, negative-cache, and stale-answer settings
• Client network allow/deny rules and per-client query limits
• Live dashboard metrics through SignalR
• Statistics, client, domain, blocklist, category, and log management
• Windows Service hosting

Requirements

• .NET 6 or .NET 8 runtime
• Port 53 available for the DNS listener
• Port 80 available for Blocky overview stats
• Port 9999 available for the default local administration interface

The administration interface binds to http://127.0.0.1:9999/ by default. Configure the web and DNS endpoints before exposing the application to another network.

Running on Windows

When port 80 is already reserved by HTTP.sys, stop the conflicting reservation from an elevated Command Prompt:

net stop http

The DNS executable also supports Windows Service installation:

EonaCat.Dns.exe /install
EonaCat.Dns.exe /uninstall

Run these commands from an elevated Administrator console. The service is created with Automatic startup.

Running on Linux

Make sure port 53 is free:

sudo lsof -i :53

On systems using systemd-resolved, disable its stub listener and point the host resolver at Blocky:

# /etc/systemd/resolved.conf
[Resolve]
DNS=127.0.0.1
DNSStubListener=no

Then restart systemd-resolved and ensure /etc/resolv.conf points to /run/systemd/resolve/resolv.conf:

sudo systemctl restart systemd-resolved
sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

Do not start Blocky until the existing DNS service has released port 53.

Configuration

The web interface exposes the main DNS settings. The underlying EonaCatDnsConfig model also supports:

• IPv4/IPv6 listen and resolver addresses
• Standard DNS and DoH forwarders
• DNSSEC algorithm selection (ECDSAP256, ECDSAP384, or ED25519)
• Cache size, TTL, negative-cache, and serve-stale limits
• Client network allow/deny lists and query-rate/burst limits
• Optional DNS-over-TLS on port 853
• TSIG keys and authenticated updates or zone transfers
• Plugin loading and secondary-zone configuration

Treat the administration interface and any DNS-over-TLS certificate material as production secrets. Put externally exposed administration endpoints behind HTTPS, authentication, firewall rules, or a reverse proxy.

Log files

Blocky uses EonaCat.LogStack and writes daily files under the runtime logs directory:

• blocky-startup_* - startup, setup, and host lifecycle
• dns-server_* - DNS listener, catalog, DNSSEC, and server lifecycle
• dns-query_* - DNS query and response events
• multicast_* - multicast DNS lifecycle and errors
• blocky-web_* and dns-web_* - web request and framework diagnostics
• dns-general_* - DNS background services and uncategorized errors

Verbose per-query text logging is disabled by default. Enable it from Network > DNS resolution > Verbose query text logs when detailed query text is required. Structured query records and metrics remain available while it is disabled.

License

Licensed under the Apache License, Version 2.0. See LICENSE.