# Network rules

Network rules work with IP addresses instead of domain names. They do two independent jobs: identifying which network a query comes from, and blocking answers that point into address ranges you choose.

## Linked client ranges: map networks to a configuration

**Classic DNS carries no configuration id**, so for plain port-53 setups you link your network's public IP address or range (in CIDR form, like `203.0.113.0/24`) to a configuration. Every query arriving from that range gets that configuration's rules. This is how an office, a school building or a home router gets filtered without touching every device; see [router setup](../setup/router.md).

You can link several ranges to one configuration, and different ranges to different configurations. When ranges nest, the most specific one wins, so a branch office inside the company range can have its own rules. Queries from unlinked addresses fall back to the neutral default configuration. Ranges are IPv4 today.

**If your public IP changes** (common on home connections), update the linked range; until you do, your queries are answered unfiltered rather than with someone else's rules. Encrypted DNS with your id in the [hostname or URL](../connect.md) avoids the problem entirely.

## Blocked answer ranges: refuse answers by destination

The second kind of rule looks at where an answer points. Add a blocked answer range and any lookup whose result lands inside it is refused, whatever the domain. Useful for cutting off a hosting range that keeps serving abuse, or enforcing "nothing on this network talks to that address space" without enumerating domains. IPv4 ranges today; your [allowlist](custom-rules.md) does not override these blocks, since they are address-based on purpose.

Back to [features](index.md).