mirror of
https://github.com/vyos/vyos-documentation.git
synced 2025-10-26 08:41:46 +01:00
dns-forwarding: use new cfgcmd/opcmd syntax
This commit is contained in:
Christian Poessinger
parent
a31914a5da
commit
eff5a68ce2
@ -4,75 +4,63 @@
|
||||
DNS Forwarding
|
||||
##############
|
||||
|
||||
Use DNS forwarding if you want your router to function as a DNS server for the
|
||||
local network. There are several options, the easiest being 'forward all
|
||||
traffic to the system DNS server(s)' (defined with set system name-server):
|
||||
VyOS provides DNS infrastructure for small networks. It is designed to be
|
||||
lightweight and have a small footprint, suitable for resource constrained
|
||||
routers and firewalls, for this we utilize PowerDNS recursor.
|
||||
|
||||
VyOS DNS forwarder doe not require an upstream DNS server. It can serve as a
|
||||
full recursive DNS server - but it can also forward queries to configurable
|
||||
upstream DNS servers.
|
||||
|
||||
.. cfgcmd:: set service dns forwarding system
|
||||
|
||||
Forward incoming DNS queries to the DNS servers configured under the ``system
|
||||
name-server`` nodes.
|
||||
|
||||
.. cfgcmd:: set service dns forwarding name-server <address>
|
||||
|
||||
Send all DNS queries to the IPv4/IPv6 DNS server specified under `<address>`.
|
||||
You can configure multiple nameservers here.
|
||||
|
||||
.. cfgcmd:: set service dns forwarding domain <domain-name> server <address>
|
||||
|
||||
Forward received queries for a particular domain (specified via `domain-name`)
|
||||
to a given name-server. Multiple nameservers can be specified.
|
||||
|
||||
.. note:: This also works for reverse-lookup zones e.g. ``18.172.in-addr.arpa``.
|
||||
|
||||
.. cfgcmd:: set service dns forwarding allow-from <network>
|
||||
|
||||
Given the fact that open DNS recursors could be used on DDOS amplification
|
||||
attacts, you must configure the networks which are allowed to use this recursor.
|
||||
A network of ``0.0.0.0/0`` or ``::/0`` would allow all IPv4 and IPv6 networks
|
||||
to query this server. This is on general a bad idea.
|
||||
|
||||
Example
|
||||
=======
|
||||
|
||||
Router with two interfaces eth0 (WAN link) and eth1 (LAN) does want to make
|
||||
use of DNS split-horizon for example.com.
|
||||
|
||||
* DNS request for example.com need to get forwarded to IPv4 address 192.0.2.254
|
||||
and IPv6 address 2001:db8:cafe::1
|
||||
* All other DNS requests are forwarded to DNS server listening on 192.0.2.1,
|
||||
192.0.2.2, 2001:db8::1:ffff and 2001:db8::2:ffff
|
||||
* DNS server is listening on the LAN interface addresses only, 192.168.1.254
|
||||
for IPv4 and 2001:db8::ffff for IPv6
|
||||
* Only clients from the LAN segment (192.168.1.0/24) are allowed to use this
|
||||
server
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
set service dns forwarding system
|
||||
set service dns forwarding domain example.com server 192.0.2.254
|
||||
set service dns forwarding domain example.com server 2001:db8:cafe::1
|
||||
set service dns forwarding name-server 192.0.2.1
|
||||
set service dns forwarding name-server 192.0.2.2
|
||||
set service dns forwarding name-server 2001:db8::1:ffff
|
||||
set service dns forwarding name-server 2001:db8::2:ffff
|
||||
set service dns forwarding listen-address 192.168.1.254
|
||||
set service dns forwarding listen-address 2001:db8::ffff
|
||||
set service dns forwarding allow-from 192.168.1.0/24
|
||||
set service dns forwarding allow-from 2001:db8::/64
|
||||
|
||||
Manually setting DNS servers for forwarding:
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
set service dns forwarding name-server 8.8.8.8
|
||||
set service dns forwarding name-server 8.8.4.4
|
||||
|
||||
Manually setting DNS servers with IPv6 connectivity:
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
set service dns forwarding name-server 2001:4860:4860::8888
|
||||
set service dns forwarding name-server 2001:4860:4860::8844
|
||||
|
||||
Setting a forwarding DNS server for a specific domain:
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
set service dns forwarding domain example.com server 192.0.2.1
|
||||
|
||||
Set which networks or clients are allowed to query the DNS Server. Allow from all:
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
set service dns forwarding allow-from 0.0.0.0/0
|
||||
|
||||
Examples
|
||||
========
|
||||
|
||||
Example 1
|
||||
---------
|
||||
|
||||
Router with two interfaces eth0 (WAN link) and eth1 (LAN). Split DNS for example.com.
|
||||
|
||||
* DNS request for a local domain (example.com) get forwarded to 192.0.2.1
|
||||
* Other DNS requests are forwarded to Google's DNS servers.
|
||||
* The IP address for the LAN interface is 192.168.0.1.
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
set service dns forwarding domain example.com server 192.0.2.1
|
||||
set service dns forwarding name-server 8.8.8.8
|
||||
set service dns forwarding name-server 8.8.4.4
|
||||
set service dns forwarding listen-address 192.168.0.1
|
||||
set service dns forwarding allow-from 0.0.0.0/0
|
||||
|
||||
Example 2
|
||||
---------
|
||||
|
||||
Same as example 1 but with additional IPv6 addresses for Google's public DNS
|
||||
servers.
|
||||
|
||||
The IP addresses for the LAN interface are 192.168.0.1 and 2001:db8::1
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
set service dns forwarding domain example.com server 192.0.2.1
|
||||
set service dns forwarding name-server 8.8.8.8
|
||||
set service dns forwarding name-server 8.8.4.4
|
||||
set service dns forwarding name-server 2001:4860:4860::8888
|
||||
set service dns forwarding name-server 2001:4860:4860::8844
|
||||
set service dns forwarding listen-address 2001:db8::1
|
||||
set service dns forwarding listen-address 192.168.0.1
|
||||
set service dns forwarding allow-from 0.0.0.0/0
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user