Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are curently using the DNS of our ISP but i would like to setup our own in house dns server so that we could manage local names, and in short use this in house DNS server instead of .hosts file on all of our computers.

I would like the DNS server to resolve DNS only to certain IP's (so this way i could filter internet access in a way, by providing DNS resolution only to domains that are of use to our business and accordingly to IP's -something like openDns) -i know i could setup a transparent squid to do filtering, but i've been interested in seting up a local DNS server and could not find the necesary resources online.

I am interested in a unix, debian, friendly app (windows is accepted also).

any thoughts ?

share|improve this question

12 Answers 12

up vote 4 down vote accepted

I'd recommend PowerDNS highly, if you just want a no-frills recursing DNS server to enable Internet usage, pdns-recursor requires close to zero configuration to be used on a local network. I use it on our FreeBSD server on the office, and basically, I just installed it, added the server's IP address to /usr/local/etc/pdns/recursor.conf and started the service.

If you want to provide your own DNS information, PowerDNS has some very powerful features, mainly in its ability to use a relational database as backend, which makes it a lot easier to make some sort of web interface or configuration system, and also makes it a lot easier to do replication, since you can just use the database server's replication system instead of AXFR or similar things.

share|improve this answer
2  
Storing production DNS data in an SQL database adds additional risk to a piece of critical infrastructure. Unless the system has a process to cope with the failure of the SQL server, I would implement something that uses traditional flat files. –  Matt Jun 2 '09 at 21:17
2  
Well, all systems have risks. Flat files might get corrupted, databases might go down. There's performance tradeoffs to flat files, especially if your zones change a lot or have a lot of records. So if you only have a few simple zones, I'd agree that having an RDBMS might be overkill. –  mikl Jun 6 '09 at 20:38

I can tell you on the Linux side that BIND is probably the most common and most powerful solution you could find. However, DNSmasq is a great lightweight DNS app that you actually might have some experience with since it's installed on many linux-based SOHO routers.

share|improve this answer
    
BIND i am considering, but has anyone got any substantial how-to out there.... i would really appreciate this. i have not been able to setup this so far. –  s.mihai May 30 '09 at 20:56
    
It's not a simple project, but this is a good place to start: bind9.net/links –  scotthere May 31 '09 at 17:41

I would recommend Linux + BIND or PowerDNS.

The setup is fairly easy with lots of HOWTOs on the web. I use this setup for 3 years now without any problem.

HOWTO for BIND an internal and external DNS server

share|improve this answer
    
power dns seems interesting... i'll look into that :-? –  s.mihai May 30 '09 at 20:55

DJBDNS - easy, works! :)

share|improve this answer
3  
I'm not going to go so far as to vote you down, but DJBDNS has to be the most convoluted piece of software I've used since Qmail. The kludges it takes to install DJBDNS are just wrong. The only thing going for it is the (too) simple configuration. –  Matt Simmons May 30 '09 at 20:57
    
How's that? I see your point for distro's on which you have to manually install daemontools etc. but it does have to be like that. Both daemontools and djbdns are in Lenny's default repo. It's still a bit non-standard, but its configuration beats the hell out of binds. –  wzzrd Jun 1 '09 at 9:15
    
Nobody should be using djbdns nowadays. It doesn't do DNSSEC. Not to mention, it has three CVE listings against it, only one of which there is a really good easy fix for. –  Mark Johnson Dec 25 '12 at 5:17

I thought about doing the same thing, and came across OpenDNS.

I'm a new user, so I can't add the link, but google will allow you to find them.

I don't work for/with them, I just use their service and I like it. Its free and allows for customizing access like you requested. As far as local DNS is concerned, I run a localized nameserver for all hostnames of of a Fedora install. As far as the local DNS goes, as long as you are running a DNS server on the network, and have your DHCP configured correctly to spit it out, it'll work. I simply don't allow DNS traffic originating from my exterior firewall, and it seems to do the trick.

share|improve this answer
    
yes, i've tried OpenDNS but i can not allow access only to whitelisted websites and deny access to blacklisted. This is what i am trying to do. –  s.mihai May 30 '09 at 21:01

Small sites often hand-edit zone files and BIND configurations which leads to inconsistencies and errors. Instead use HostDB to take a /etc/hosts file and uses it to generate your files. More info at everythingsysadmin.com/hostdb

It generates files for BIND which comes with all Linux distros.

share|improve this answer
    
it's not for my webserver, but i am interested in securing web access in our network this way. –  s.mihai May 30 '09 at 21:07

Using a DNS Server for local/internet name resolution is the best and most managmenable solution. With that having been said I would suggest you do not use DNS for filtering. Use something that was designed for web content filtering like squid.

If using a windows server then use Windows DNS Server if using a Linux server use something like Bind or dnsmasq.

share|improve this answer
    
1. at the moment i am using the DNS provided by my ISP 2. centralized file sharing (no centralized auth) 3. we already have a DHCP in place. only DNS required. –  s.mihai May 30 '09 at 21:29
    
What operating system on the server and workstations ? –  JJ01 May 30 '09 at 22:43
    
the stations are windows based. the server... i have both linux based, and windows based servers around, i'ld like to use someting cheap (open source) and user friendly –  s.mihai May 31 '09 at 4:51

I use an internal DNS server for that purpose exactly.

Windows DNS Services is an added component to their systems. The application is easy to use, but as difficult as DNS is to understand. How to Install and Configure Microsoft DNS Server

I also use Simple DNS. This application runs in windows as it's own DNS service. There are much more features for configuration, and the web API is worth the price alone. Consider using a DNS web API for DNS management outside of the IT realms.

share|improve this answer

djbdns: easy configuration and syntax, top notch security.

share|improve this answer
    
No DNSSEC. The security is not as good as folks claim, either, go check the CVE entries. –  Mark Johnson Dec 25 '12 at 5:18

For a recursive resolver, Unbound. For authoritative server, NSD.

share|improve this answer

Aptitude install bind9 will provide a caching nameserver out of the box. From there you're only a hop, skip and a jump away from adding your own zone files to control your networks DNS as you wish.

share|improve this answer

I have no experience with anything else then BIND and the Microsofts AD integrated one.

What you want is quite possible, for BIND this would mean that you clear out the root hints and configure forwards to the domains you do allow to their authoritative DNS server.

Though as said here, I would not go that way, I override the DHCP's proclaimed DNS server with my own preference, so if I would be on your network I could happily browse where I want to, unless you have another restriction, but then it would be a waste of time to cripple your DNS server in the first place.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.