BIND override A record possible?

jtl · Jul 10, 2017, 1:56 AM

Hi

I'm looking on using BIND reverse policy zone to replace an IP address in a 'A' record resolved using my router (pfSense) BIND instance. The purpose of doing this, is I have a server on my network that is hosting services, and all it's incoming and outgoing traffic is tunneled through an IPSec tunnel in a datacenter close by for some DDoS resilience and avoiding ISP port blocks, etc. Anyways, said tunnel has a public IP of it's own and so I'm looking into how to use BIND reverse policy zone to replace said IP with the server's LAN IP in DNS queries, to avoid routing traffic from LAN to the server over the external tunnel, which frankly seems like a waste of bandwidth to me.

I currently just use 1:1 NAT on the tunnels public IP and make an exception for the server, but obviously it's not an ideal solution.

Is it possible using BIND to override any A record that resolves to a certain IP to another IP address? I'd like to avoid keeping two copies of my zone files if it all possible.

Thanks

johnpoz · Jul 14, 2017, 5:34 PM

This is possible with all 3 dns options on pfsense, dnsmasq (forwarder), unbound (resolver) it is simple host override. With bind package just create your view you want and the let the view access the specific zone with your override in it.

jtl · Jul 21, 2017, 1:13 AM

I know that.

What I was looking to do is override an A record in any query.

i.e if any A record queried by the server is "192.168.1.2" replace with "192.168.1.4"

Thanks anyways.

johnpoz · Jul 21, 2017, 9:56 AM

you can do a redirect so anything in a domain returns an IP.. Pretty sure that can be done in all 3 as well.

So if you query bob.domain.tld you get 192.168.1.4, if you query susan.domain.tld or kevin.domain.tld etc..

You want to only redirect and return 192.168.1.4 if what is queried resolves to 192.168.1.2?? But you don't know what is going to be queried?

"override any A record that resolves to a certain IP to another IP address?"

So you don't know what this FQDN A record is??

jtl · Jul 25, 2017, 2:52 AM

So you don't know what this FQDN A record is??

Right. But I know what the original and "spoofed" A record response should be.

johnpoz · Jul 25, 2017, 12:46 PM

Huh?

If you do not know what the fqdn is - how would you create a record for it to be a different IP. If you want to create a PTR record so if say 1.2.3.4 PTR returns host.domain.tld then you can do that. But for you to change what a FQDN returns you need to know what that is.. Or at min you need to know what the domain is.. So you could setup so anything.domain.tld returns IP 1.2.3.4. But if you don't even know what domain it is then no you can not do what your asking. Or if you want host.domain.tld to return its actual value and someotherhost.domain.tld something else you need to know what that someotherhost.domin.tld is..

jtl · Jul 26, 2017, 1:02 AM

Fair enough.

Thanks for the help.

I could have sworn I've seen such functionality (replace a matched returned 'A' record with another where the FQDN is unknown) in some "penetration testing" MiTM DNS server tools, but I take it that it's not possible with any "mainstream" DNS server (Unbound, BiND, etc.)

johnpoz · Jul 26, 2017, 2:10 AM

Yeah what your talking about doing would be hack for sure!!