Selective DNS Caching/Forwarding

MaestroRC asks: "I've been looking around online, and I have found several people wanting to do the same thing, but no one seems to have figured it out yet. What I am wanting to do (and before you go further, understand this is for work, i.e.: no innocent people will be harmed in the implementation) is to set up a name server that selectively forwards queries. For example, I would like to create a list of acceptable domains (less than 20) using wildcards such as *.google.com, that the name server will forward a query on to and reply to normally. For anything not in the list, I want it to reply NXDOMAIN or some such. I've looked at BIND, and there doesn't appear to be a way to do what I'm wanting; it can either have recursion on or off, and any specific zones of type forward still do not forward if it is off. The solution doesn't have to be pretty, and it can just be a simple DNS proxy, but I'm not adept at coding, so it needs to be installable by a regular sysadmin on Linux. Has anyone heard of something like this?"

Comments

Re:Straight to the packet filtering?

[arivanov]

No need to drop.

Selectively change the destination name server using DNAT and send it to a fake name server. I use a similar hack for other less nefarious purposes. It used to be (before wireless hotspot ops got inventive) a very good way of supplying roaming clients with a well behaved and working DNS. You set the nameservers in the client to two well known, well behaved nameservers so it works with the VPN down. You also set the firewall/VPN gw to hijack all traffic to these well known nameservers coming down the VPN and direct it to your nameservers. As a result the clients consistently get good DNS after the VPN gets brought up and you do not get any silly split DNS scenarios.

Alternatively, besides master and slave there are several less known zone types. You should be able to achieve results similar to what you are looking for by using forward or stub type zones. This will give you a "bind-only" solution without playing silly firewall games.

Re:Can be done with W2K3 DNS Server...

[Phormion]

BIND also provides exactly this through forward zones, nothing spectacular here.

Re:Ask Slashdot, the non IT troubleshooting forum

[jamesh]

Hi Slashdot. A friend of mine has been hitting on me for a few weeks now. And while I like him, his advances makes me uncomfortable. How do I tell him that I don't want a relationship, without damaging the friendship that we share?

There's nothing you can do. His side of the friendship is based on the fact that he wants to bone you. The best you can hope for is that he gets the idea that one of your friends thinks he's cute... then maybe he'll bother her instead.

Yo Slashdot. I've got this yellowish reddish spot. It's about the size of a quarter, and it's getting bigger. And it's all puffy and stuff. It's right on the back of my knee, but it doesn't really hurt. Should I be worried?

Try bathing.

Hello. I'm going to Bill's house for a party, so I thought I'd bring a bottle of Castello di Borghese 71. But dear Muffy says that Bill just returned form the Promise clinic, and has to stay clean. What else should I bring to a party instead of wine? A dog or something?

Depriving you of a drinking buddy is one of the most selfish things a man can do. If he can't handle the booze then that's his own problem. Don't let it ruin your day.

I have a 1989 chevy K2500 that has a vacuum problem. truck runs very rough at idle. has a new egr valve that is working properly, new egr solenoid, all vacuum lines are good, everything is working like it is supposed to except that i am getting almost twice the vacuum to the egr than it is supposed to get. has anyone seen this problem before or any tips? thanks alot!

Your car clearly sucks. Deal with it.