Re: [Hampshire] DNS lookup and VPNs

Top Page

Reply to this message
Author: Adrian Bridgett
Date:  
To: Hampshire LUG Discussion List
Subject: Re: [Hampshire] DNS lookup and VPNs
On Wed, Feb 6, 2008 at 14:40:33 +0000 (+0000), Andy Smith wrote:
> Hi Hugo,
>
> On Wed, Feb 06, 2008 at 02:28:41PM +0000, Hugo Mills wrote:
> >    Thus, the main question is: Can I tell my laptop to use one DNS
> > server for a specific subdomain, but use the DNS server provided by
> > DHCP for all other domains?

>
> I believe you can *almost* do this by use of forward zones, but for
> anything but the forward zones the queries would then go out to the
> DNS roots as usual.


Or setup forwarders for those:

options {
   forwarders {
      1.2.3.4;
      5.6.7.8;
   };
   // ask nameservers first, only ask root nameservers
   // if forward nameservers do not respond
   forward first;
};


This all involves running a DNS server on your laptop, and configuring
DHCP client to populate the named.conf file appropriately.

> zone "carfax.org.uk" {
>         type forward;
>         forwarders {
>                 10.2.0.18;
>         };
> };


Personally I just have my VPN tell the VPN client the DNS details,
this then uses resolvconf to setup /etc/resolv.conf:

http://www.smop.co.uk/mediawiki/index.php/OpenVPN

With the VPN as the preferred resolvconf device, this means that my
/etc/resolv.conf is either:

non-VPN:
nameserver 1.2.3.4
search example.org

VPN:
nameserver 192.168.100.3
nameserver 1.2.3.4
search smop.co.uk example.org

The only issue here is that if I then lookup foo.example.org my
nameserver might say "nope, doesn't exist". Whereas the 1.2.3.4
nameserver might know about it. This happens if foo.example.org is an
internal only name. You _might_ be able to get your nameserver to
say "I'm not authorative for example.org" if that's a big problem, but
I've not looked into it.


Adrian
--
Email: adrian@??? -*- GPG key available on public key servers
Debian GNU/Linux - the maintainable distribution -*- www.debian.org