Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We are running a research project with hundreds (becoming thousands) of remote hosts. Each host is running OpenVPN so we can find them regardless of what their 'assigned' IP is. We have been using DynDNS to manage this but we're running into some issues with them ( API is weak/nonexistent, size constraints, etc).

Im looking into setting up a internal-only domain (EG "our.stuff" so a host would be "site1.our.stuff" or "site3.net4.our.stuff") that I can configure with the info from the OpenVPN server.

Since we'd have to point our internal DNS to this machine it would have to be able to route/cache requests for 'external' machines as well. I've been trying to read about 'internal DNS', 'private', 'non-routeable' but I'm not having much success.

Summary: need info on internal, caching DNS server. Something with open-source would be ideal. If not, I can script out changes to .conf, etc.

share|improve this question

migrated from stackoverflow.com Mar 2 '11 at 3:07

This question came from our site for professional and enthusiast programmers.

1  
what platform/OS? also try on serverfault.com –  rene Mar 1 '11 at 21:11
    
try this cr.yp.to/djbdns.html –  rene Mar 1 '11 at 21:16

3 Answers 3

up vote 1 down vote accepted

I would use bind, open source that powers the DNS root servers and security tried and proved (every week, I would say).

Configure a simple server with recursion and a simple internal domain (you can call it whatever you want) that will be served by this domain. Recursion can be allowed only for some IP adresses and it's a good practice to do so, even if your DNS server will not be exposed to the internet:

acl recurseallow { x.x.x.x; x.x.x.x; x.x.x.x; };
options {
<some other options you have already>
allow-recursion { recurseallow; };
};

Bind also supports dynamic dns updates and you can use the nsupdate tool to make the openvpn clients update the nameserver with their names. It uses cryptographic keys to do everything securely and works wonders. Here is a short tutorial about nsupdate and one about Dynamic DNS.

share|improve this answer
    
It looks as though I will need an 'update-policy' entry for every one of my remote hosts. Is this accurate? Im hoping to automate this process as much as possible. –  ethrbunny Mar 2 '11 at 14:17
    
This document describes a way of doing it that doesn't include the policy thing. I think that's not necessary and we don't use it here on our DDNS. –  coredump Mar 2 '11 at 14:25
    
Looks like we'll do something along these lines. I don't look forward to updating all of our existing clients though.. job security? –  ethrbunny Mar 4 '11 at 18:20
    
Big pain on the beginning but it pays off :) –  coredump Mar 4 '11 at 18:23

What you want is a DNS server that can do both "recursive queries" and be authoritative for this domain that you want to set up. I'd recommend ignoring the idea of "internal DNS", just consider it a regular DNS server with both authoritative and recursive abilities. It's "internal" in that you only allow it to be accessed from your networks, say by placing it behind your firewalls or limiting access to it, that really doesn't impact the configuration.

I would probably choose "BIND", which is open source and very widely available, mostly because I'm familiar with it. But pretty much anything that isn't a caching-only server will work. For example, you could use "PowerDNS", but not the caching-only variant of it called "pdns-recursor".

In BIND, you'd want to set "allow-recursion" to the list of your IP addresses that you want to be able to access it, and then set up a zone for the OpenVPN IPs. You can either use a dynamic DNS update tool to modify the zone (make sure the zone file and the directory that it is in is writable by the DNS server -- that's the #1 problem users have in this configuration), or use a shell script or something up update the zone file directly.

share|improve this answer

It would be possible to dynamically create DNS entries when the OpenVPN client connects that can be queried by you locally or by the client through the VPN tunnel.

One such approach might be to setup DNS back-ended by LDAP

http://freshmeat.net/projects/ldap2dns/

Then you can use pre-post scripts in OpenVPN to add or modify DNS entries. See something like this for an example on how pre/post scripts interacting with LDAP work

http://planetjoel.com/viewarticle/638/OpenVPN%3A+Dynamically+create+IPtables+rules+based+on+LDAP+group+membership

Otherwise you could backend with MySQL which may be a bit simpler using a similar kind of approach.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.