Can DNS Forwarder implement views like Bind?
-
Currently setting up some servers in a new datacenter. There are three vlans the Proxmox hypervisor knows about and it has a bridge interface for each (vmbr0, vmbr1, vmbr2). Proxmox will provision a VM NIC on a given bridge to make it part of that vlan. I need to get DNS setup for the vlans.
Historically, I've use Bind for this and setup views. Hosts received answers to their queries base on which "view" their source IP address fell into. I've not touched views in a couple years so my recollection might be a bit rusty.
I hate bind. Nobody wants to touch it and my backup person to train is a windows guy so getting him into the cli to manage bind zones is going to be a pita. I thought it would be nice to see if pfSense will work for this....
I see a DNS Forwarder and DNS Resolver I did some poking around in the forums and found DNS Forwarder is apparently the way to go. Then use Host Overrides to cover the specific hosts that need to resolve to what Bind would call an "internal view".
This is great for a single "view" but is there a way to base the answer to a DNS query on the host IP address? The only other way I can see this working is spinning up a pfSense VM on each bridge. And I'm desperate enough to actually do that. Just wanted to check beforehand to make sure I'm not missing something.
-
@dave-r2 Try this with DNS resolver:-
https://forum.netgate.com/topic/158427/solved-multi-homed-host-question/3?_=1615242967885
-
@nogbadthebad That would get pretty busy with more than a /29 in there. Thanks though, good to know.
-
@dave-r2 you could create the config outside of pfsense via a script and upload them, point to them them like this:-
server:include: /var/unbound/filename_*.conf
-
@nogbadthebad Thanks. I really love that pfSense has an implement to pull this off. The trouble with this is I need to train "non command line" folks on how to make changes too. If it's not a web browser, they'll get all sweaty. Having them make line edits containing quotes and colons is just not going to go well. I appreciate you taking the time to noodle this out though. My pfSense knowledge isn't exactly guru level.
