Difference between revisions of "Configure DNS"
(Change source-code blocks to standard format) |
m (→Setting up local domains names) |
||
| (15 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
| − | < | + | == Local caching non-forwarding DNS Server == |
| + | <onlyinclude>Setting up a local caching non-forwarding DNS server is a good idea to ensure that DNS requests return quickly (especially useful if you have sites that make requests before returning the pages). It's also essential if you're running ''spam assassin'' because the domain black-lists (DNSBL) services operate over DNS and will often block requests made from large ISP's DNS servers.</onlyinclude> The term non-forwarding is confusing, but [http://social.dnsmadeeasy.com/blog/understanding-dns-forwarding/ forwarding] is actually something that authoritative servers do as part of processing recursive queries by sending parts that they can't resolve up the chain to a root server. A non-forwarding server is non-authoritative and simply refers requests to external DNS servers for names that are not cached or local. | ||
| − | + | The most popular DNS server is [http://bind9.net/ Bind9] and is set up in caching configuration by default, but the [https://nlnetlabs.nl/projects/unbound/documentation/ unbound] DNS resolver is becoming very popular too, and is the default in some BSD distros now, it's light-weight, fast, modern and more secure in most applications than ''bind''. Both ''bind'' and ''unbound'' should be in local caching non-forwarding configuration out of the box. | |
| − | |||
| − | + | First install ''bind9'' or ''unbound'': | |
<source> | <source> | ||
| − | + | apt-get install [bind9|unbound] | |
</source> | </source> | ||
| + | Change the ISP name servers in your ''/etc/resolv.conf'' file to use the new local server instead: | ||
| + | <source> | ||
| + | search com | ||
| + | nameserver 127.0.0.1 | ||
| + | </source> | ||
| − | + | '''Note:''' Don't forget to check ''/etc/network/interfaces'' and comment out any DNS servers specified there too. | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | + | You can ensure that your new DNS server is indeed in local caching configuration with by checking that port 53 is only open to local requests with '''netstat -nlp|grep :53''' | |
<source> | <source> | ||
| − | + | tcp 0 0 {!127.0.0.1!}:53 0.0.0.0:* LISTEN 893/unbound | |
| − | + | tcp6 0 0 {!::1!}:53 :::* LISTEN 893/unbound | |
| − | + | udp 0 0 {!127.0.0.1!}:53 0.0.0.0:* 893/unbound | |
| − | } | + | udp6 0 0 {!::1!}:53 :::* 893/unbound |
</source> | </source> | ||
| + | == Setting up local domains names == | ||
| + | Requests under the organisation's domain name from the Internet must be forwarded to the ISP-assigned external IP address using an A-record. This may require Dynamic DNS if a static IP address arrangement has not been made with the ISP. | ||
| − | + | Requests made for the domain from within the LAN require the local DNS server to resolve the request to resolve to the internal LAN IP address of the server, but to refer all other requests to an external DNS server. | |
| + | The following example is for a domain called ''foo.com'' which has an internal Nextcloud on ''office.foo.com''4. This example assumes that the domain is configured correctly for resolving external requests, including dynamic DNS, and focusses on the configuration of the DNS server running internally on the LAN, and the internal Nextcloud server (which probably runs the DNS server too) on IP address 192.168.1.2. | ||
| − | + | Install ''unbound'' as shown above, then edit ''/etc/unbound/unbound.conf'' and append the following configuration: | |
<source> | <source> | ||
| − | + | server: | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| + | interface: 0.0.0.0 | ||
| + | access-control: 192.168.1.0/24 allow | ||
| + | verbosity: 1 | ||
| − | + | cache-min-ttl: 3600 | |
| − | + | cache-max-ttl: 86400 | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | + | private-address: 192.168.1.0/24 | |
| − | + | private-domain: "foo.com" | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| + | local-zone: "foo.com." static | ||
| + | local-data: "office.foo.com. IN A 192.168.1.2" | ||
| + | local-data-ptr: "192.168.1.2 office.foo.com" | ||
| − | + | forward-zone: | |
| − | + | name: "." | |
| − | + | forward-addr: 208.67.222.222 | |
| − | + | forward-addr: 208.67.220.220 | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
</source> | </source> | ||
== Notes == | == Notes == | ||
*Be sure to increase the serial number each time a zone file is edited or the changes will be ignored | *Be sure to increase the serial number each time a zone file is edited or the changes will be ignored | ||
| − | *Remember to reload the zone files after making changes with ''' | + | *Remember to reload the zone files after making changes with '''service bind9 reload'''. |
*Note the "1" in the last line of the reverse lookup is the last digit of the DNS server's IP address | *Note the "1" in the last line of the reverse lookup is the last digit of the DNS server's IP address | ||
| Line 119: | Line 88: | ||
*4.2.2.5 | *4.2.2.5 | ||
*4.2.2.6 | *4.2.2.6 | ||
| + | |||
| + | == Dynamic DNS == | ||
| + | It's often useful to be able to access machines on our local LAN's from other locations. Most of the LAN's we need to access machines on do not have static IP addresses, so a [[w:Dynamic DNS|Dynamic DNS]] solution is used to keep a domain name up to date with the current IP address. | ||
| + | |||
| + | Our .com domain host is [http://www.namecheap.com namecheap.com] and they provide a free dynamic DNS solution allowing simple HTTP query-string based method of updating a sub-domain. We just add a single entry to ''/etc/crontab'' which looks like this (replace SUB, DOMAIN and PASS with your specific settings): | ||
| + | <source> | ||
| + | */10 * * * * nobody wget -q --spider "http://dynamicdns.park-your-domain.com/update?host=SUB&domain=DOMAIN&password=PASS" | ||
| + | </source> | ||
| + | |||
| + | The subdomain will automatically be created when the first request is made if it didn't previously exist. The password is shown in the namecheap.com admin site in the "DynamicDNS" section for the appropriate domain. | ||
== See also == | == See also == | ||
| + | *[[Hosting]] | ||
*[http://www.cyberciti.biz/faq/howto-enable-dns-linux-unix-server-logging/ Turn on query logging] | *[http://www.cyberciti.biz/faq/howto-enable-dns-linux-unix-server-logging/ Turn on query logging] | ||
| − | |||
*[http://www.opendns.com/ OpenDNS] ''- free fast DNS servers that aren't Google'' | *[http://www.opendns.com/ OpenDNS] ''- free fast DNS servers that aren't Google'' | ||
| + | *[https://wiki.opennic.org/opennic/tier2setup Setting up a tier-2 OpenNIC server] | ||
| + | *[https://dnswatch.com/dns-docs/UNBOUND/ Sample configuration for Unbound DNS server] | ||
| + | [[Category:Procedures]] | ||
Latest revision as of 10:56, 4 May 2022
Contents
Local caching non-forwarding DNS Server
Setting up a local caching non-forwarding DNS server is a good idea to ensure that DNS requests return quickly (especially useful if you have sites that make requests before returning the pages). It's also essential if you're running spam assassin because the domain black-lists (DNSBL) services operate over DNS and will often block requests made from large ISP's DNS servers. The term non-forwarding is confusing, but forwarding is actually something that authoritative servers do as part of processing recursive queries by sending parts that they can't resolve up the chain to a root server. A non-forwarding server is non-authoritative and simply refers requests to external DNS servers for names that are not cached or local.
The most popular DNS server is Bind9 and is set up in caching configuration by default, but the unbound DNS resolver is becoming very popular too, and is the default in some BSD distros now, it's light-weight, fast, modern and more secure in most applications than bind. Both bind and unbound should be in local caching non-forwarding configuration out of the box.
First install bind9 or unbound:
apt-get install [bind9|unbound]Change the ISP name servers in your /etc/resolv.conf file to use the new local server instead:
search com
nameserver 127.0.0.1Note: Don't forget to check /etc/network/interfaces and comment out any DNS servers specified there too.
You can ensure that your new DNS server is indeed in local caching configuration with by checking that port 53 is only open to local requests with netstat -nlp|grep :53
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 893/unbound
tcp6 0 0 ::1:53 :::* LISTEN 893/unbound
udp 0 0 127.0.0.1:53 0.0.0.0:* 893/unbound
udp6 0 0 ::1:53 :::* 893/unboundSetting up local domains names
Requests under the organisation's domain name from the Internet must be forwarded to the ISP-assigned external IP address using an A-record. This may require Dynamic DNS if a static IP address arrangement has not been made with the ISP.
Requests made for the domain from within the LAN require the local DNS server to resolve the request to resolve to the internal LAN IP address of the server, but to refer all other requests to an external DNS server.
The following example is for a domain called foo.com which has an internal Nextcloud on office.foo.com4. This example assumes that the domain is configured correctly for resolving external requests, including dynamic DNS, and focusses on the configuration of the DNS server running internally on the LAN, and the internal Nextcloud server (which probably runs the DNS server too) on IP address 192.168.1.2.
Install unbound as shown above, then edit /etc/unbound/unbound.conf and append the following configuration:
server:
interface: 0.0.0.0
access-control: 192.168.1.0/24 allow
verbosity: 1
cache-min-ttl: 3600
cache-max-ttl: 86400
private-address: 192.168.1.0/24
private-domain: "foo.com"
local-zone: "foo.com." static
local-data: "office.foo.com. IN A 192.168.1.2"
local-data-ptr: "192.168.1.2 office.foo.com"
forward-zone:
name: "."
forward-addr: 208.67.222.222
forward-addr: 208.67.220.220Notes
- Be sure to increase the serial number each time a zone file is edited or the changes will be ignored
- Remember to reload the zone files after making changes with service bind9 reload.
- Note the "1" in the last line of the reverse lookup is the last digit of the DNS server's IP address
Public DNS servers
- 208.67.222.222
- 208.67.220.220
- 8.8.8.8
- 8.8.4.4
- 2001:4860:4860::8888
- 2001:4860:4860::8844
- 156.154.70.1
- 156.154.71.1
- 198.153.192.1
- 198.153.194.1
Verizon
- 4.2.2.1
- 4.2.2.2
- 4.2.2.3
- 4.2.2.4
- 4.2.2.5
- 4.2.2.6
Dynamic DNS
It's often useful to be able to access machines on our local LAN's from other locations. Most of the LAN's we need to access machines on do not have static IP addresses, so a Dynamic DNS solution is used to keep a domain name up to date with the current IP address.
Our .com domain host is namecheap.com and they provide a free dynamic DNS solution allowing simple HTTP query-string based method of updating a sub-domain. We just add a single entry to /etc/crontab which looks like this (replace SUB, DOMAIN and PASS with your specific settings):
*/10 * * * * nobody wget -q --spider "http://dynamicdns.park-your-domain.com/update?host=SUB&domain=DOMAIN&password=PASS"The subdomain will automatically be created when the first request is made if it didn't previously exist. The password is shown in the namecheap.com admin site in the "DynamicDNS" section for the appropriate domain.
See also
- Hosting
- Turn on query logging
- OpenDNS - free fast DNS servers that aren't Google
- Setting up a tier-2 OpenNIC server
- Sample configuration for Unbound DNS server
