Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×

Selective DNS Caching/Forwarding 61

Posted by Cliff from the resolve-only-what-you-want-it-to dept.
MaestroRC asks: "I've been looking around online, and I have found several people wanting to do the same thing, but no one seems to have figured it out yet. What I am wanting to do (and before you go further, understand this is for work, i.e.: no innocent people will be harmed in the implementation) is to set up a name server that selectively forwards queries. For example, I would like to create a list of acceptable domains (less than 20) using wildcards such as *.google.com, that the name server will forward a query on to and reply to normally. For anything not in the list, I want it to reply NXDOMAIN or some such. I've looked at BIND, and there doesn't appear to be a way to do what I'm wanting; it can either have recursion on or off, and any specific zones of type forward still do not forward if it is off. The solution doesn't have to be pretty, and it can just be a simple DNS proxy, but I'm not adept at coding, so it needs to be installable by a regular sysadmin on Linux. Has anyone heard of something like this?"
This discussion has been archived. No new comments can be posted.

Selective DNS Caching/Forwarding More

Selective DNS Caching/Forwarding

Comments Filter:
  • It won't work for the simple reason that you need dns glue, and you can't control where the glue will come from.

  • Can be done with W2K3 DNS Server... (Score:5, Informative)

    by ErMaC ( 131019 ) <ermac@@@ermacstudios...org> on Thursday October 19, 2006 @12:54AM (#16497225) Homepage
    I'm not a Linux person, but I know a way you could do this with Windows Server 2003 DNS Server...
    It has an option called "conditional forwarding" where you can forward anything ending with "example.com" to the DNS server x.x.x.x - just set up the DNS server and then set conditional forwarding of the domains you want to allow to a real DNS server.
    We use this for setting up trusts between separate Active Directories but it could conceivably be used for this purpose as well.
  • Why not just use packet filtering to drop DNS packets from your DNS caching server that do not contain the whitelisted domains in their payload? Your DNS caching daemon would just temporarily fail.

    • Re:Straight to the packet filtering? (Score:5, Informative)

      by arivanov ( 12034 ) on Thursday October 19, 2006 @02:20AM (#16497781) Homepage
      No need to drop.

      Selectively change the destination name server using DNAT and send it to a fake name server. I use a similar hack for other less nefarious purposes. It used to be (before wireless hotspot ops got inventive) a very good way of supplying roaming clients with a well behaved and working DNS. You set the nameservers in the client to two well known, well behaved nameservers so it works with the VPN down. You also set the firewall/VPN gw to hijack all traffic to these well known nameservers coming down the VPN and direct it to your nameservers. As a result the clients consistently get good DNS after the VPN gets brought up and you do not get any silly split DNS scenarios.

      Alternatively, besides master and slave there are several less known zone types. You should be able to achieve results similar to what you are looking for by using forward or stub type zones. This will give you a "bind-only" solution without playing silly firewall games.

  • I stumbled upon this link [oreilly.com] you may be able to pull the electronic version of the book from somewhere... I don't know if this helps.

  • BIND can kind of do what you want. So can perl. (Score:2, Informative)

    by Anonymous Coward
    I tried to do something similar to this once. In BIND, you can define a zone called "." In there, add a record "* IN A 127.0.0.1" (this isn't really NXDOMAIN, but it does prevent people from getting places :)). Then create forward zones for each domain you want to resolve properly.

    There are [at least] 2 problems with this. 1) You have to keep the forwarders up to date for the zones you list. 2) If google decides to make www.google.com a CNAME for www.google.akamai.net (OK, Google probably wouldn't do th
    • add a record "* IN A 127.0.0.1" (this isn't really NXDOMAIN, but it does prevent people from getting places :)).

      It gets mighty confusing if you're running a web server locally. Like my Mac does. And I have taken it onto networks that like sending you to 127.0.0.1. And wondered why I was getting my own website.

      • Re: (Score:3, Informative)

        by Bargearse ( 68504 )
        So set it to something other than 127.0.0.1 -- 127.0.0.2 for example :)

        Even better set it to the IP of a webserver that throws up an information page explaining why you can't browse to the site you're trying to visit, and who to contact if you think it's a mistake/problem.

        Of course that won't help anything other than web traffic, but I'm guessing that's the main point of this exercise.

        • Actually, the reserved localhost network is a full class-A, 127.x.x.x, so sending to 127.0.0.2 will have the same result on most clients.
        • 127.0.0.2 is, in any decent stack, also localhost. Actually 127/8 should all point to localhost, and is explicitly reserved for this use.

          The IP-of-a-webserver is a decent approach, though. So long as said server has the rest of its ports explicitly closed, not stealthed.

      • Re:BIND can kind of do what you want. So can perl. (Score:5, Informative)

        by dmayle ( 200765 ) on Thursday October 19, 2006 @03:11AM (#16498103) Homepage Journal

        Forget the whole 127.0.0.1 game playing, this is VERY simple with BIND

        Simply create zones for the domains you want to forward on to be looked up as type forward and disable the "." zone

        And since when did Ask Slashdot become an IT troubleshooting forum?

        • Slashdot has always been an IT troubleshooting forum. What else are you going to do with it? Drink beer? I admit, beer and tacos are a good mix.

        • Ask Slashdot, the non IT troubleshooting forum (Score:5, Funny)

          by cgenman ( 325138 ) on Thursday October 19, 2006 @04:56AM (#16498635) Homepage
          Hi Slashdot. A friend of mine has been hitting on me for a few weeks now. And while I like him, his advances makes me uncomfortable. How do I tell him that I don't want a relationship, without damaging the friendship that we share?

          Yo Slashdot. I've got this yellowish reddish spot. It's about the size of a quarter, and it's getting bigger. And it's all puffy and stuff. It's right on the back of my knee, but it doesn't really hurt. Should I be worried?

          Hello. I'm going to Bill's house for a party, so I thought I'd bring a bottle of Castello di Borghese 71. But dear Muffy says that Bill just returned form the Promise clinic, and has to stay clean. What else should I bring to a party instead of wine? A dog or something?

          I have a 1989 chevy K2500 that has a vacuum problem. truck runs very rough at idle. has a new egr valve that is working properly, new egr solenoid, all vacuum lines are good, everything is working like it is supposed to except that i am getting almost twice the vacuum to the egr than it is supposed to get. has anyone seen this problem before or any tips? thanks alot!

          • Re:Ask Slashdot, the non IT troubleshooting forum (Score:5, Funny)

            by jamesh ( 87723 ) on Thursday October 19, 2006 @06:28AM (#16499019)
            Hi Slashdot. A friend of mine has been hitting on me for a few weeks now. And while I like him, his advances makes me uncomfortable. How do I tell him that I don't want a relationship, without damaging the friendship that we share?

            There's nothing you can do. His side of the friendship is based on the fact that he wants to bone you. The best you can hope for is that he gets the idea that one of your friends thinks he's cute... then maybe he'll bother her instead.

            Yo Slashdot. I've got this yellowish reddish spot. It's about the size of a quarter, and it's getting bigger. And it's all puffy and stuff. It's right on the back of my knee, but it doesn't really hurt. Should I be worried?

            Try bathing.

            Hello. I'm going to Bill's house for a party, so I thought I'd bring a bottle of Castello di Borghese 71. But dear Muffy says that Bill just returned form the Promise clinic, and has to stay clean. What else should I bring to a party instead of wine? A dog or something?

            Depriving you of a drinking buddy is one of the most selfish things a man can do. If he can't handle the booze then that's his own problem. Don't let it ruin your day.

            I have a 1989 chevy K2500 that has a vacuum problem. truck runs very rough at idle. has a new egr valve that is working properly, new egr solenoid, all vacuum lines are good, everything is working like it is supposed to except that i am getting almost twice the vacuum to the egr than it is supposed to get. has anyone seen this problem before or any tips? thanks alot!

            Your car clearly sucks. Deal with it.

          • Re: (Score:2)

            by orasio ( 188021 )
            Hi Slashdot. A friend of mine has been hitting on me for a few weeks now. And while I like him, his advances makes me uncomfortable. How do I tell him that I don't want a relationship, without damaging the friendship that we share?

            He will understand if you don't want a relationship. If he gets romantic on you, just give him a BJ for comfort, and tell him you only want to be friends.


            Yo Slashdot. I've got this yellowish reddish spot. It's about the size of a quarter, and it's getting bigger. And it's all puff

        • Re: (Score:1)

          by Bipoha ( 540839 )
          I imagine dnscache (djbdns recursive name server) could do this.

          I'd try deleting all the entries in /var/services/dnscache/root/servers/@,
          and adding files named as the domains you want to look up, containing only
          the IP address(es) of the name servers you want to forward to.

          Nuking that @ file appears to give you the NXDOMAIN error like you desire:

          [root@blah servers]# cat /dev/null > @
          [root@blah servers]# svc -h /var/services/dnscache
          [root@blah servers]# host www.monster.com 192.168.1.1
          Using domain server

          • Re: (Score:1)

            by Bipoha ( 540839 )
            I just thought of something... (Actually, I had to go to bed first...and THEN realize this) The IP addresses you put into the domain-named files have to be authoritative name servers. So, whatever you get from a 'host -t ns slashdot.org' has to be in the "slashdot.org" file, etc. Make sure you use IP addresses, and not the hostnames for obvious reasons. OK, back to bed...

  • NetReg (Score:2, Interesting)

    by GraffitiKnight ( 724507 )
    If you check out NetReg [netreg.org], in the download and installation instructions they have steps on how to set up forwards like this. NetReg uses it to require people to register their MAC address. Anyone not registered is forwarded to the registration page, but it would be simply to modify it using their example. We use NetReg at our university, and I am working expanding some of its functionality for my senior project.
    • We use netreg at my university (and I work for the IT netsec dept); if you're looking for specific functionality, we might be able to help. Drop me an email.
  • I'm not sure if Posadis will meet your requirements or not. See here: http://posadis.sourceforge.net/ [sourceforge.net]

    Something else to look into is this code written in Visual Basic* - please don't laugh - I've been using a hacked version for some time now to cache results and to pass certain lookups through tor_resolve. Url: http://www.csh.rit.edu/~jon/projects/caching_dns/ [rit.edu].

    (If the author is reading this I've been meaning to say "thanks"!)
  • This might not work as requested but it works for my home network and parenting needs.

    pdnsd [freshmeat.net]
  • Can use winroute (kerio package) to act as a DNS only, have it default deny, then make up the wildcards you want (yes, it supports standard * and ! wildcards).

    eg

    *.google.com

    www!.yourworkdomain.com

    *sourceforge.net

    • Re: (Score:1)

      by Barny ( 103770 )
      Argg, took a look at our winroute setup (dimly remeber setting it up ages ago) and it would need to be acting as a proxy to do this.

      Allways another option of course, block everything at the firewall and lock down their access at the proxy.
  • Forwarding requires recursion turned on. However, you can set up internal root nameservers which have a trimmed-down version of the DNS namespace, and also slave the zones you're interested in. This can be done very well with BIND.
  • What's the use in alowing google and not alowing the sites it links to?

    I assume you will try to block google cache somehow, otherwise the workaround is rather easy as well...
  • Since you're trying to filter people's web access, and block teh pr0n, I'd say you should look into decent web caching software. Something like Squid surely has a way to only allow certain URLs.
    • If you're going the squid route, DansGuardian works great! It's easy to configure and blocks out a lot of crap!
    • I mentioned this to a previous comment, but you may not see it. I wasn't very clear on this point; the computers we're restricting are at 100 (literally) different locations, and we only have a tiny T1 pipe at the central office. In other words, it's not efficient for us to do caching/proxying. Right now we're using DNS set to 1.1.1.1 and a hosts file to do the same thing, but it's getting annoying updating 100 sites when a host changes or needs to be added.

      • Re: (Score:3, Informative)

        by cr0sh ( 43134 )
        Why is it annoying? Aside from the fact that you have to update a hosts file (ugh), you should just have a cron job (or equiv) on each of those computers to pull down the new hosts file and install it, at some "low usage" time (depending on where the computers are located geographically/timezone-wise). An even better solution would be: if those machine are individual workstations, set up a "host file server" at each group of computers location - and have them pull from their local "cache" copy on that serve
  • Wouldn't a proxy server be better suited to this?
  • Twisted DNS [twistedmatrix.com] should be pretty customizable, although your "I'm not adept at coding" will probably make it hard for you. Still, I throw it out there, in case someone else has an application that requires customized DNS. From a cleanliness and safety aspect, it's sure a better starting point than BIND.
  • ... that I'm glad this isn't (apparently) too easy to do? It should always be hard to break standards, especially on the Internet. Otherwise, the next thing you know, when powerful interest groups (think MPAA, RIAA, et al.) get large ISPs (think AOL, Comcast, et al.) in their back pockets... well, I think you can guess what happens next.

    Break this! *obscene hand gesture*
  • My daughter had an online class. The class required IE, Flash, JS, and other holes in security counter to my web browsing guidelines. To prevent it becoming a melted down bot, I pointed it's network setting for DNS to localhost instead my residential gateway. (I know, I just broke the web) I then manualy put just the 7 required sites in the hosts file with correct URL addresses. The end result was the school sites worked and nothing else did. The online course worked like a charm without getting owned

Slashdot Top Deals

If you have a procedure with 10 parameters, you probably missed some.

Close