DNS for mulitple VLANS
-
Hi All,
I have a question im struggling to find the answer too. So im hoping someone here can help.I have 2 subnets where all traffic is blocked between them.
I the have a server that exists on both with the name nas.example.com with IP 192.168.1.50 amd 192.168.11.50.
When a machine on the 192.168.1.x subnet queries for nas.example.com, i only want pfsense to return the IP for the same subnet.
I have seen this is possible the the DNS Forwarder function, but is the same possible for the DNS Resolver?
Any help or pointers would be appreciated.
Regards, -
@tompark unbound has a “view” feature but I don’t know any details offhand so it’s not much of a pointer but might help.
-
@tompark yeah as @SteveITS mentions you can setup a views to do this.. I have gone over it a few times in multiple posts.. Let me see if I can find one of my old posts.
edit: here is post from back in 2017 ;)
https://forum.netgate.com/post/684870
I know I have done since then with more details... Hold on
edit2: here is a whole thread trying to help the guy setup a simple view - but never actually got exactly what he was wanting to do or to what.. But there are multiple posts in there by me showing how to setup a view.
https://forum.netgate.com/post/1145332
You could prob do it with rpz as well vs a view.. I have to step away for a bit, later tonight I might right up both ways to do it.
You want unbound to return the IP of the nas that is in the same network as the client that is doing the query right..
-
@johnpoz - thank you for the links! Yes I want to return the IP for NAS that is in the same Subnet (not any other subnet).
A sample guide on something like this might be good for others. I'll have a read of the two threads tomorrow or maybe Monday and see what I come up with.
-
@tompark so here this is really simple.. So my nas has entry in unbound for 192.168.9.10.. So currently if anything queries nas.home.arpa it gets back 192.168.9.10
I created a view and access list that says hey anything from 192.168.3.0/24 that queries you, use this entry for nas.home.arpa that has IP of 192.168.3.42
So if any of my other networks query for nas.home.arpa they get back the normal 192.168.9.10, if anything from 192.168.3.0 queries they will get 192.168.3.42 as you see above that last query is from a pi I have on the 192.168.3 network.
Now here is a query from my device I have on the 192.168.2.0/24 network
If I get myself motivated can show you how to do with a rpz..
I had to call out specific IPs on my pfsense when I did the digs, because most of all of my devices point to my pihole, which is on the 192.168.3 network... So currently none of those devices can actually resolve my nas - hehe ;) Time to comment the view out..
-
Thank you for the information, unfortunately the screen shots don't load :(.
I have been reading the unbound docs to learn more about views. Is it possible to get unbound to forward a zone for a particular view to a different DNS server?
For one of the VLAN's if possible I would like to forward the DNS queries to a Windows DC (I know this is not best practice). Sites on the DC are configured, however is there any changes to unbound I would need to make to ensure the DC returned the right address.
As for the settings for the views do these get added directly to the configuration files or too the "custom options" box in DNS Resolver.
Apologies it has taken a while for me to respond a few other things took over meaning I needed to leave this alone for a bit.
Regards,
-
@tompark they did way back almost 3 weeks ago when I posted them.. Seems the latest update to the forum software had some gremlins at work..
Forwarding to some other NS can be problematic - I haven't paid attention to see if the latest version of unbound maintains different caches for different views like bind does.
Here is where you can have a problem.. User A queries something, and its cached.. Now user B does a query from different IP that view should return something different than what user A got, but since it is in the common cache user B gets what was cached vs what the view should of returned.
The views get added to the custom option box..
The thread I posted to has really all the details you would need for creating a view.
-
@johnpoz, hum thats what i thought. I will follow the othere thread and see where I end up.
I appreciate all the guidance and adviae that you have proevided. I jave a good base to start from now.
