Internal only DNS?

Question

We are running a research project with hundreds (becoming thousands) of remote hosts. Each host is running OpenVPN so we can find them regardless of what their 'assigned' IP is. We have been using DynDNS to manage this but we're running into some issues with them ( API is weak/nonexistent, size constraints, etc).

Im looking into setting up a internal-only domain (EG "our.stuff" so a host would be "site1.our.stuff" or "site3.net4.our.stuff") that I can configure with the info from the OpenVPN server.

Since we'd have to point our internal DNS to this machine it would have to be able to route/cache requests for 'external' machines as well. I've been trying to read about 'internal DNS', 'private', 'non-routeable' but I'm not having much success.

Summary: need info on internal, caching DNS server. Something with open-source would be ideal. If not, I can script out changes to .conf, etc.

Answer 1

I would use bind, open source that powers the DNS root servers and security tried and proved (every week, I would say).

Configure a simple server with recursion and a simple internal domain (you can call it whatever you want) that will be served by this domain. Recursion can be allowed only for some IP adresses and it's a good practice to do so, even if your DNS server will not be exposed to the internet:

acl recurseallow { x.x.x.x; x.x.x.x; x.x.x.x; };
options {
<some other options you have already>
allow-recursion { recurseallow; };
};

Bind also supports dynamic dns updates and you can use the nsupdate tool to make the openvpn clients update the nameserver with their names. It uses cryptographic keys to do everything securely and works wonders. Here is a short tutorial about nsupdate and one about Dynamic DNS.

Answer 2

What you want is a DNS server that can do both "recursive queries" and be authoritative for this domain that you want to set up. I'd recommend ignoring the idea of "internal DNS", just consider it a regular DNS server with both authoritative and recursive abilities. It's "internal" in that you only allow it to be accessed from your networks, say by placing it behind your firewalls or limiting access to it, that really doesn't impact the configuration.

I would probably choose "BIND", which is open source and very widely available, mostly because I'm familiar with it. But pretty much anything that isn't a caching-only server will work. For example, you could use "PowerDNS", but not the caching-only variant of it called "pdns-recursor".

In BIND, you'd want to set "allow-recursion" to the list of your IP addresses that you want to be able to access it, and then set up a zone for the OpenVPN IPs. You can either use a dynamic DNS update tool to modify the zone (make sure the zone file and the directory that it is in is writable by the DNS server -- that's the #1 problem users have in this configuration), or use a shell script or something up update the zone file directly.

Answer 3

It would be possible to dynamically create DNS entries when the OpenVPN client connects that can be queried by you locally or by the client through the VPN tunnel.

One such approach might be to setup DNS back-ended by LDAP

http://freshmeat.net/projects/ldap2dns/

Then you can use pre-post scripts in OpenVPN to add or modify DNS entries. See something like this for an example on how pre/post scripts interacting with LDAP work

http://planetjoel.com/viewarticle/638/OpenVPN%3A+Dynamically+create+IPtables+rules+based+on+LDAP+group+membership

Otherwise you could backend with MySQL which may be a bit simpler using a similar kind of approach.