# PS5 User Guide DNS gateway -- nanoDNS-style policy.
#
# Config model adapted from https://github.com/drakmor/nanoDNS#config, but the
# unmatched-name behaviour is deliberately inverted to default-DENY.
#
# Resolution order for each query:
#   1. the source address must fall inside [general] allowed_clients, otherwise
#      the query is dropped and logged as "denied";
#   2. a name matching an [exceptions] mask is forwarded to [upstream];
#   3. otherwise a name matching an [overrides] mask is answered with its IPv4;
#   4. otherwise NXDOMAIN. Unlike upstream nanoDNS, names that match no rule are
#      NOT forwarded, which keeps PSN, updates and telemetry blocked by default.
#
# Masks use shell-style wildcards:  *  ?  [abc]  [a-z]  [!0-9]
# Names are matched case-insensitively.

[general]
redirect_url = http://192.168.20.30:8000/
# Source networks allowed to query this resolver (comma/space/newline separated).
# Consoles VLAN /28, server VLAN /24, trusted management VLAN /27.
allowed_clients = 192.168.40.0/28, 192.168.20.0/24, 192.168.10.0/27

[upstream]
# Resolvers tried in order; the first valid answer wins. Several may be listed,
# separated by commas, spaces or newlines. Must be IP addresses, not hostnames.
server = 1.1.1.1
timeout_ms = 3000

[overrides]
# mask = IPv4  -- matched names are answered with this address (A records).
manuals.playstation.net = 192.168.20.30

[exceptions]
# One mask per line (no address) -- matched names are forwarded upstream. These
# are the reviewed homebrew-store, PS5 Payload Manager, Spectrum Library and
# BlackBox endpoints. Everything not listed here or in [overrides] is NXDOMAIN.
homebrew.page
itsplk.github.io
store.spectrumlibrary.online
api.github.com
github.com
raw.githubusercontent.com
release-assets.githubusercontent.com
prosperopatches.com
cdn.prosperopatches.com
image.api.playstation.com
gmedia.playstation.com