Visit Our UNIX and Linux User Community


Configure OpenDNS

 
Thread Tools Search this Thread
Operating Systems Linux Red Hat Configure OpenDNS
# 1  
Old 01-06-2011
Configure OpenDNS

We are using internal DNS server to relove for internal systems, and the same DNS server resolves any external domains for example yahoo.com

I would like to use openddns to resolve the external domains and put some control.

I looked at the resolve.conf file and it is as follows

search myinternaldomain.com
nameserver 127.0.0.1


My first question is why the nameserver is pointing to 127.0.0.1,
How is it resolving the external domains.

should I just add the opendns entry here in the resolv.conf


TIA
# 2  
Old 01-06-2011
Well, 127.0.0.1 is ok for resolv.conf on the name server, very portable unless you want to see it from the outside. Any client app will use resolv.conf to find a name server, so that name server must be an ip or in /etc/hosts to give the ip.

The server side of having a domain is to have a parent list you as its child. Then, even if hosts point to other initial name servers, they get the answers from you.

DNS is a bit insecure, so it is nice to use it with dnssec, which in turn requires that you get a certificate trusted by someone trusted.

You can put some convenient lies in DNS, but I am not sure what sort of "control" you get. I once set up a DNS that said aol was the firewall, where there was a forwarding proxy to the real aol. Since all external DNS inquiry went through the firewall DNS server, it intercepted all such requests.

You do not need roots to get DNS going, you use your ISPs DNS as your roots, and they redirect you to the real ones so you do not have to know when they change.
This User Gave Thanks to DGPickett For This Post:
# 3  
Old 01-07-2011
MySQL

Quote:
Originally Posted by atish0
We are using internal DNS server to relove for internal systems, and the same DNS server resolves any external domains for example yahoo.com

I would like to use openddns to resolve the external domains and put some control.
The question that come to mind is why? What do you expect to gain by doing this?
What controls are you looking for here?

Quote:
I looked at the resolve.conf file and it is as follows

search myinternaldomain.com
nameserver 127.0.0.1


My first question is why the nameserver is pointing to 127.0.0.1,
Because it doesn't need to look anywhere else to resolve requests as it knows how to do this itself.

Quote:
How is it resolving the external domains.
Because it knows how to ask the ROOT servers where to find the information it is looking for.

Quote:
should I just add the opendns entry here in the resolv.conf
You could but it would not help you. resolv.conf is used by programs on that system only not others requesting DNS information.

I can think of one great reason why you should not mess with this server. You don't understand how DNS works or configured. Your best bet is to learn how to configure DNS servers, on another test system, before you mess with this server so you don't bring all connections to a stand still because DNS is not working.
# 4  
Old 01-07-2011
Yes, resolv.conf or equivalent information is at the client end of DNS, so when apps call gethostbyname() they know where to go besides the hosts file or such. Being dumb clients, they call the first working DNS server in there to resolve the name, selecting randomly, possibly with their domain tacked on the right end. Names ending in '.' do not get domains tried on the right end.

The first DNS server probably does not know the answer, unless he serves that domain, so as the poor client asked for recursion, he will keep asking dns servers (without recursion, so he can build his cache) until he has an answer. Then, he will cache it for its lifetime. For ftp.boulder.ibm.com, knowing nothing, he would call his root server for the "com" domain (top level), which should be his ISP, but if you are the ISP, you need to keep your list of real roots up to date. The "com" server will say go bother the name servers for "ibm.com" and give a list, the nameservers for "ibm.com" may say go ask "boulder.ibm.com" DNS nameservers, and give a list. One of them will answer you. You will cache all of these answers for their lifetime. The real root servers are a pile of computers in two tiers, with the first tier host forwarding to a right choice on the second tier based on database segmentation, and the second sending answers directly, a triangular circuit, since UDP is connectionless!

That was DNS server life on the client side.

The DNS server side involves a parent that says you control some subtree of the world's namespace and knows your master and your slaves's names and IPs, zone transfers from your master to your slaves, domain and host information for the domains you control. BIND puts this in simple text files, but some implementations use RDBMS, LDAP, or even the Windows name server thing that I forget already! Any domain can have many servers, but only one should be master and be updated.

DNS is very simple for the query, UDP packets on one unconnected socket port 53, and one packet in drives one packet out, generally. Lost packets are not a big deal, as the end client will time out and resend his query. DNS Server internal state involves remembering recursion requests not filled, so when answers final or partial arrive, the answer or next question, respectively, can be sent. Zone transfers move the domain info from master to slave on the same socket number but TCP port 53 (slaves pull, as I recall). Security gets hacked when unsolicited bogus packets arrive, and are trustingly accepted, poisoning the cache. DNSSEC ensures the packets are from the real sending server, who is trusted by chain, using encryption and signatures.

Firewall DNS is common, so the hosts internally, either end clients or internal DNS servers supporting the end clients while protecting the firewall from that load, and possibly on unroutable addresses like 10.*, are not exposed as they seek IP addresses on the Internet. Your hosts accessible from the Internet can be name-hosted there, although you need an outside visible backup server or so for reliability if not bandwidth. Internal DNS can tell lies to send internal apps to a firewall for proxy access to real hosts on the outside. Since firewall tasks involve a lot of reverse DNS, having a server handy speeds things up and reduces network load.

DNS can provide failover reliability, if each app server is a DNS server for itself. Clients skip over dead DNS servers looking for live DNS servers, and the live DNS server says it is the app server. DNS server choice is random, spreading the load on all live servers somewhat evenly.

See, DNS is beautiful, elegant and not so hard. Did I miss anything Google and man cannot fill in?

Last edited by DGPickett; 01-07-2011 at 06:40 PM..
This User Gave Thanks to DGPickett For This Post:
# 5  
Old 01-10-2011
Quote:
Originally Posted by Lazydog
The question that come to mind is why? What do you expect to gain by doing this?
What controls are you looking for here?

Because it doesn't need to look anywhere else to resolve requests as it knows how to do this itself.

Because it knows how to ask the ROOT servers where to find the information it is looking for.

You could but it would not help you. resolv.conf is used by programs on that system only not others requesting DNS information.

I can think of one great reason why you should not mess with this server. You don't understand how DNS works or configured. Your best bet is to learn how to configure DNS servers, on another test system, before you mess with this server so you don't bring all connections to a stand still because DNS is not working.

If you look at opendns.com, opendns service allows to block dns queries to sites , like I want to block radio sites, phishing sites, porn and more.
This is management requirement.

The current DNS was built by my pre-decessor, I just want to resolve external sites using the opendns name server 208.67.222.222 and 208.67.220.220

I havent worked with bind, that is why I am asking the gurus, after reading I think I need to change the root hints to point to opendns

Last edited by atish0; 01-10-2011 at 02:57 PM..
# 6  
Old 01-11-2011
Well, even if there was no blocking built in as such, you can define any domain name server or host as localhost 127.0.0.1, just like Spybot S&D Immunize, or whatever target you desire to give a graceful denial response. It falls under "lies you can tell"! Smilie

Too bad http GET is not as elegant as DNS query. No connection delay and bandwidth use, one server socket for all, one in for one out, different hosts can answer and you can even use broadcast IPs with UDP to hit redundant hosts on the same subnet!
# 7  
Old 01-12-2011
Then instead of changing the root hints file just make your dns server a forward only system that forwards everything to opendns.

Make a backup copy of named.conf before editing anything so you can back out if there is a problem.
Look at the config file for options and change it like so:

Code:
options {
        forward only;
        forwarders {
            <first ip of opendns>;
            <second ip of opendns>;
        };
    };

This User Gave Thanks to Lazydog For This Post:

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

./configure

hello, I'm trying install apache http server version 2.2.22. I downloaded the file httpd-2.2.22.tar.bz2. I unzipped this file.. When I type "./configure", the following error occurs: # ./configure --prefix=/opt/work/apache2.2.22 checking for chosen layout... Apache checking for... (1 Reply)
Discussion started by: Adriano Schmidt
1 Replies

2. Red Hat

Configure RPM

Hi..i need to install package (*.rpm) on RHEL 6.2 . I have those patches available in RPM disc. When i try using below command rpm -ivh <package name> it give me following error no key warning:user mockbuild does not exist - using root warning:group mockbuild does not exist - using root... (3 Replies)
Discussion started by: deljatt
3 Replies

3. Solaris

Configure virtual ip - second ip

Hello Group, Could you please help me with the procedure to configure a virtual ip (second ip) under the same interface in Solaris 11. Thanks in advance ! (2 Replies)
Discussion started by: csierra
2 Replies

4. Linux

how to configure wireless now ?

Hi, I've installed wireless card and I didn't receive any error in the installation process. Now I want to use it but I can't make internet to work. if I check my card with iwconfig I get the following message wlan0 IEEE 802.11g ESSID:"Alice-34376718" Mode:Managed ... (2 Replies)
Discussion started by: aneuryzma
2 Replies

5. Programming

How to configure emacs? Thank!

I am using emacs to write c++ code. How to configure it to let the system highlight C++ keywords, variables, etc; and let it automatically indent, just like a common C++ IDE does? Any suggestions? Thanks! (1 Reply)
Discussion started by: meili100
1 Replies

6. HP-UX

HP-UX 10.20 Network Configure

Hi I'm new about UNIX, but I've to use a HP9000 with HP-UX 10.20 workstation. I'm trying to configure the network, I've configured the file /etc/rc.conf.d/netconf with my IP address and the right gateway, so the HP9000 is on the net, I've tried a ping. But now I've a problem I can't start hte CDE,... (4 Replies)
Discussion started by: gofmass
4 Replies

7. UNIX for Advanced & Expert Users

How to configure dktab

Hi: I need some information about how to configure a dktab archive to make mirroring with ide disk. I have to know the necesary steps to make that. Thanks. (2 Replies)
Discussion started by: dvl
2 Replies

8. UNIX for Dummies Questions & Answers

./configure error

my compiler won' t let me configure. This is what occurs when I type ./configure Alex@BADPERSON /postgresql-7.2.1 $ ./configure loading cache ./config.cache checking host system type... i686-pc-cygwin checking which template to use... win checking whether to build with locale support... no... (3 Replies)
Discussion started by: achink125
3 Replies

9. UNIX for Advanced & Expert Users

How to configure DNS

My OS is sun solaris7,(sun sparc),i want connect inernet and my computer in my company intranet.After i configure proxy server,i still can't conncet internet.I guess whether the DNS is configured correctly. who can help me???Thank you very much!!! (6 Replies)
Discussion started by: q30
6 Replies

10. UNIX for Dummies Questions & Answers

IP configure

Hi people I am having problems getting a few Sun Station to work again. We just moved to a new building with new IPs and new gateways. I need to change all these settings. Could some one please tel me what files I have to change. It is a Solaris 5.7 machine. Thanx O:confused: (2 Replies)
Discussion started by: Orange
2 Replies

Featured Tech Videos