iptables filter DNS AAAA query on VPS

Host PC that support IPv6 protocol query a domain name procedure is send AAAA DNS query first, then A DNS record, that would delay response time, because most of website cannot support ipv6 and that they doesnot have ipv6 domain record, we need suppressed AAAA dns query before all of website enabled ipv6 protocol.

First I have tried to disable ipv6 on my host pc by executed "echo 1 > /proc/sys/net/ipv6/all/disable_ipv6​" but it not work, then I have trying to drop AAAA dns query on my intermediate NAT& VPN device, following is the method that work fine to me.

Reference:

http://stackoverflow.com/questions/14096966/can-iptables-allow-dns-queries-only-for-a-certain-domain-name​

https://github.com/oskar456/xt_dns/issues/1​

Method 1: Use iptables extension xt_dns to match dns query type

step 1. download xt_dns iptables extension module source code from here:

http://software.klolik.org/xt_dns/​​

or: https://github.com/oskar456/xt_dns​

step 2. Compile & install .so file(How to compile iptables xt mod? reference here: https://github.com/netoptimizer/IPTV-Analyzer/blob/master/iptables-module/README.compile)

step 3. insmod *.so file and added iptables rules depend on ur need, following url is example, don't forget save it.

​​​​​http://software.klolik.org/xt_dns/#example

Beacause I do not have permission to  insmod  iptables on my vps, I have use then next method right now, it's works fine.

Method 2: Use iptables --match-set(-m) option

iptables -N AAAA​

iptables -I FORWARD 1 -p udp -s 192.168.0.0/16 --dport 53 -j AAAA

iptables -A AAAA -m string --algo bm --from 40 --hex-string '|001c|' -j DROP

​

reference: 'man iptables-extensions' then search 'string'