🌐 Languages: 󠁧󠁢󠁥󠁮󠁧󠁿English | Русский

Allows to set Redirect and Block rules to your Cloudflare and NextDNS accounts.

Ready-to-run via GitHub Actions. Video guide

General comparison: Cloudflare vs NextDNS

Setup credentials: Cloudflare

Setup credentials: NextDNS

Setup profile

Setup data sources

Setup exclude redirects (optional)

Multiple profiles setup

GitHub Actions

Both providers have free plans, but there are some limitations

• 100 000 DNS requests per day
• Ipv4 DNS requests are restricted by the only one IP. But you are free to use other methods: DoH, DoT, Ipv6

• 300 000 DNS requests per month (still more than enough for personal use)
• Slow API speed is restricted by 60 requests per minute. Takes significantly more time for script to save settings

1. After signing up into a Cloudflare, navigate to Zero Trust tab and create an account.

• Free Plan has decent limits, so just choose it.
• Skip providing payment method step by choosing Cancel and exit (top right corner)
• Go back to Zero Trust tab

2. Create a Cloudflare API token, from https://dash.cloudflare.com/profile/api-tokens

with 2 permissions:

Account.Zero Trust : Edit

Account.Account Firewall Access Rules : Edit

Set API token to environment variable AUTH_SECRET

3. Get your Account ID from : https://dash.cloudflare.com/?to=/:account/workers

Set Account ID to environment variable CLIENT_ID

1. Generate API KEY, from https://my.nextdns.io/account and set as environment variable AUTH_SECRET

2. Click on NextDNS logo. On the opened page, copy ID from Endpoints section. Set it as environment variable CLIENT_ID

Set environment variable DNS with DNS provider name (Cloudflare or NextDNS)

Each data source must be a link to a hosts file, e.g. https://raw.githubusercontent.com/Internet-Helper/GeoHideDNS/refs/heads/main/hosts/hosts

You can provide multiple sources split by coma: https://first.com/hosts,https://second.com/hosts

Set sources to environment variable REDIRECT

Script will parse sources, filtering out redirects to 0.0.0.0 and 127.0.0.1

Thus, parsing lines:

0.0.0.0 domain.to.block
1.2.3.4 domain.to.redirect
127.0.0.1 another.to.block

will keep only 1.2.3.4 domain.to.redirect for the further redirect processing.

• Redirect priority follows sources order. If domain appears more than one time, the first only IP will be applied.

Set sources to environment variable BLOCK

Script will parse sources, keeping only redirects to 0.0.0.0 and 127.0.0.1.

Thus, parsing lines

0.0.0.0 domain.to.block
1.2.3.4 domain.to.redirect
127.0.0.1 another.to.block

will keep only domain.to.block and another.to.block for the further block processing.

• You may want to provide the same source for both BLOCK and REDIRECT for Cloudflare.
• For NextDNS, the best option might be to set REDIRECT only, and then manually choose any blocklists at the Privacy tab.

Put domains to environment variable EXCLUDE_REDIRECT separated by coma, e.g. instagram.com,twitch.com

These domains and their subdomains:

• will be removed from existing redirect rules;
• won't be added with new ones.

All profiles get similar settings. That means BLOCK, REDIRECT and EXCLUDE_REDIRECT are shared.

Put your profiles separated by coma without whitespace into related environment variables. E.g., two NextDNS profiles must be set as shown:

• AUTH_SECRET has: secret_NextDns_1,secret_NextDns_2
• CLIENT_ID has client_id_NextDns_1,client_id_NextDns_2

In addition to setting above, list provider for each profile in environment variable DNS. For example:

• DNS has: NEXTDNS,CLOUDFLARE,NEXTDNS
• AUTH_SECRET has: secret_NextDns_1,secret_Cloudflare_1,secret_NextDns_2
• CLIENT_ID has client_id_NextDns_1,client_id_Cloudflare_1,client_id_NextDns_2

Previously generated data will be removed. Script recognizes old data by marks:

• Name prefix for List: Blocked websites by script and Override websites by script
• Name prefix for Rule: Rules set by script
• Different Session id. Session id is stored in a description field.

After removing old data, new lists and rules will be generated and applied.

If you want to clear Cloudflare block/redirect settings, launch the script without providing sources in related environment variables. E.g. providing no value for environment variable BLOCK will cause removing old related data: lists and rules used to setup blocks.

For REDIRECT:

• Existing domain will be updated if redirect IP has changed
• If new domains are provided, they will be added
• The rest redirect settings are kept untouched

For BLOCK:

• If new domains are provided, they will be added
• The rest block settings are kept untouched

Previously generated data is removed ONLY when both BLOCK and REDIRECT sources were not provided.

1. Fork repository
2. Go Settings => Environments
3. Create New environment with name DNS
4. Provide AUTH_SECRET and CLIENT_ID to Environment secrets
5. Provide DNS,REDIRECT, BLOCK and EXCLUDE_REDIRECT to Environment variables

• The action will be launched every day at 01:30 UTC. To set another time, change cron at .github/workflows/github_action.yml
• You can run the action manually via Run workflow button: switch to Actions tab and choose workflow named DNS Block&Redirect Configurer cron task