conditional dns forwarding

[michmoor]

Hello,
Maybe its late and im lacking sleep but I'm having trouble wrapping my head around how i can make this scenario work.

pfsense HA cluster running for a special needs school. They have an external DNS service (CleanBrowsing) that's handling the filtering for external domains. The problem they have is that internal domains cannot be reached as DHCP hands out the Clean Browsing DNS servers. The DNS server for clients using the external filtering service is not pfsense. So what the staff does is to log-into PC that is using pfsense as the local resolver to get to internal resources. Obviously, this is not optimal.

Is there a way to make internal resources available and only forward to the filtering service for external domains?

[johnpoz]

@michmoor setup forwarding in pfsense to whatever the dns is for this cleanbrowsing they use. Then hand out pfsense IP for clients to use for dns.

If client is looking up some local resource, that will be returned - if looking for something that is not in pfsense dns, then it will be forwarded to this cleanbrowsing NS.

[michmoor]

@johnpoz The Forwarding under System > General Setup , i suspect is what you are talking about?
The problem is that there are different profiles configured for filtering.
So teachers get one set of restrictions while students/classrooms get a different set up filtering.

[johnpoz]

@michmoor yeah that not going to work then. Because you have a shared cache.

How do the teachers get a different profile - do they point to a different IP for dns than say the students get?

What you could do is say run the dnsmasq (forwarder) along with unbound in forwarding mode - just run 1 on different port.. So say kids user the normal pfsense IP for dns. But say teachers point to the cleanbrowsing IP, but you redirect that to dnsmasq port via dns redirection, which then looks up local records and then forwards to the other cleanbrowsing IP.

Now you have different caches one in dnsmasq, one in unbound. Could be done with the bind package as well.

Or if you have a place you could run a different NS, you wouldn't have to use the port redirection thing and different port. Or have to look you might be able to setup a vip or use a different lan side interface to listen on for the other NSer running on pfsense.

I assume you have different lan side interfaces? You could have unbound listen on 1 and dnsmasq listen on different one.. And then use those IPs to hand out to your clients and depending which one they use they would use either student clean browsing or teacher cleanbrowsing.

[stephenw10]

Mmm, if it's account based are they using a local AD server or similar?