How to configure FreeBSD to redirect all DNS requests to other DNS.
We have set up FreeBSD as router for our company. We have two cards, one for lan and second for WAN whic is configured as Public static IP adress.
What I want to do is:
When some client inside our network 192.168.0.1/32 call DNS request to our old DNS server, FreeBSD is going to forward that request to other one DNS server.
Is that possible ?
Where I need to put that rule ?
Asked
Active
Viewed 2,462 times
0
adopilot
- 1,521
- 6
- 25
- 41
-
Which OS is running the old DNS server? – lg. Aug 16 '10 at 12:23
-
Both of DNS is outside my network, First one is from out Internet Service Provider and I want to redirect all to OpenDNS – adopilot Aug 16 '10 at 12:29
-
What firewall are you running? IPFW, IPF or PF? – Chris S Aug 16 '10 at 12:40
-
@Chris S IPNAT with ipnat.rules – adopilot Aug 16 '10 at 12:46
-
@Cris S, Sorry I think that is ipfw as I can see in rc.conf firewall_enable="YES" #turn on ipfw – adopilot Aug 16 '10 at 12:51
3 Answers
1
This is possible, but probably more work than needed. The short and dirty way would be to use an netcat command, and a more permanent one would be to use a forward statement in iptables (i beleive that is for BSD as well)
Another solution would be to setup the new server with a virtual address for the old servers ip (en0.0 or some such thing).
The best solution would probably be to change the DHCP server to serve the new DNS IP, and change any hard set servers to the new IP.
Jimsmithkka
- 570
- 4
- 13
-
Trick is that my DHCP is serving new DNS but users Change them manually and avoid my New DNS, Because some of domains on new DNS is blocked – adopilot Aug 16 '10 at 10:59
-
-
there is an equivalent to iptables, and i think iptables can be forced in but havent tried myself – Jimsmithkka Aug 17 '10 at 03:38
1
You should close old DNS server and block DNS traffic from internal LAN to external DNS, so your users have no other choices.
A less drastic solution, maybe discover which users are using external or old DNS (analysing traffic or firewall logs) and notify to these users that old DNS will be shutdown and than close the old DNS.
lg.
- 4,649
- 3
- 21
- 20
1
If you're running BIND on the that router, you can easily configure it to forward all requests to the appropriate external DNS server. Depending on what firewall you're running you can also easily forward packets to that router's named. The problem is going to be that the router is answering the request now, and the client expects another server to answer the request; this would appear like a classic cache poisoning attempt and many newer clients will reject it. If you want to try it and you're running IPFW, add something like this:
ipfw add 00010 fwd localhost ip from {lan} to any dns
(Note you need a kernel compiled with options IPFIREWALL_FORWARD for this to work.)
You're best option as others have mentioned is to configure your DHCP to issue the new address (or the router's and setup forwarding there, this would also reduce external network traffic potentially, as it will cache some of the DNS queries). Then log anyone who's still using any external DNS.
Chris S
- 77,945
- 11
- 124
- 216