Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite
2

how I can redirect any DNS request from the client with my Cisco Router 2621XM. I want to redirect any dns request to my own dns server. So if the client has set the dns server in their ip address setting, it had not effect.

Like directing the www request to squid proxy first. I use this in my debian server :

iptables -t nat -A PREROUTING -s 0.0.0.0/0 -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.1.50:53
iptables -t nat -A PREROUTING -s 0.0.0.0/0 -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.1.50:53

can you tell me the configuration for my cisco router with same way like above parameters.

thanks for advance. sorry for my bad english.

share|improve this question

6 Answers

up vote 2 down vote accepted

Make sure that the IP of the DNS server is in the routing table and... 

ip access-list extended transparent_dns
permit udp any any eq 53

route-map redirect_dns permit 10
match ip address transparent_dns
set ip next-hop ip.of.your.server
route-map redirect_dns permit 20

interface fax/x
ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
ip policy route-map redirect_dns
share|improve this answer
well.. I try this... and great.. its works for me. thanks . – Muhammad Resna Rizki Pratama Aug 1 '11 at 7:16
up vote 1 down vote

It may be easier (and "cleaner") to just update your DHCP server to "hand out" your own DNS server, if you are running DHCP internally as well.

share|improve this answer
Thanks for your suggestion. That is right for that situation if I have DHCP server.. But in my scenario... I don't have a DHCP server... – Muhammad Resna Rizki Pratama Jul 30 '11 at 16:33
Are you assigning the IP addresses manually across your internal network? – user48838 Jul 30 '11 at 16:47
yes.. actually I assigning the IP manually. coz. its small number of clients. – Muhammad Resna Rizki Pratama Jul 30 '11 at 17:55
Setting up DHCP is so ridiculously simple that its worth doing even in small networks. You can do it right on the Cisco in fact. (In fact the whole reason behind your question is that you're having trouble keeping track of your small # of clients. Don't make more work for yourself; do it right and configure DHCP! Keep it simple!) – MikeyB Jul 30 '11 at 18:31
up vote 1 down vote

Trying to make this work the way you're asking is far from ideal. I'd suggest you setup an access-list on your cisco router to permit and log all DNS requests that don't come from your DNS server. This way you can discover which clients are misconfigured and correct them.

share|improve this answer
I think so. I can't imagine how I can do it work with my cisco router. Because this is my teacher's question too. :D . – Muhammad Resna Rizki Pratama Jul 30 '11 at 18:08
and about the permit and log all DNS request it's will me make work twice. I must create and see the log, and then check the client, and reconfigured if DNS setting is incorrect. It will so difficult for large number of clients :D . fortunately, number of my clients are small. this is just small-scale experiments in my class. – Muhammad Resna Rizki Pratama Jul 30 '11 at 18:15
up vote 1 down vote

Setting up DHCP is so ridiculously simple that its worth doing even in small networks. You can do it right on the Cisco in fact. (When I'm back at a computer I'll find the commands :) )

The whole reason behind your question is that you're having trouble keeping track of your "small number" of clients. Don't make more work for yourself by putting in a weird configuration; do it right and configure DHCP!

The right answer in system administration is ALWAYS: Keep it simple!

share|improve this answer
ohh.. OK. I was give up for this problem.. your answer is right "keep it simple". I'm not remember that. :D I was told by my teacher about that. I was so determined to find out how to solve this problem. And at this time, I give up. I will use the simplest way. – Muhammad Resna Rizki Pratama Aug 1 '11 at 3:07
How to actually do it is mentioned on this page. YMMV. – MikeyB Aug 1 '11 at 3:37
up vote 0 down vote

What you can do is to block all outbound DNS requests from any machine except your DNS server.

Is your concern unconfigured clients or deliberately configured ones? If the former, they should be using DHCP and if the latter tell them to fix their settings when they complain.

share|improve this answer
1  
Actually it's possible using NAT. It's been awhile since I've been on a Cisco so the exact configuration escapes me. – h0tw1r3 Jul 30 '11 at 16:06
I also think that I must use the NAT configuration. But I still don't know the right parameters.. – Muhammad Resna Rizki Pratama Jul 30 '11 at 16:31
You can do an outside global destination translation. But if the destination is on the network as the source you'll have to mangle both the src and dest. If the DNS server was on a separate interface it'd be easy. – MikeyB Jul 30 '11 at 18:28
up vote 0 down vote

The general principle woul dbe "set up DHCP, if you absolutely need to monitor, set up an ACL permitting DNS lookups to your DNS server, then set up one permitting DNS but logging it" (or, blocks, I guess, but it's probably better to allow and log in this case).

If you absolutely need to redirect DNS requests, you'll need to use policy-routing. I don't know if you can re-write the destination address using polciy-routing, but you can definitely set the next hop. Be aware that enabling policy-routing will most probably drop the router throughput by a factor 10-100.

share|improve this answer
I was doubt for using policy-routing. I was using policy-routing for redirect to my proxy server. But, I still doubt to use for this problem. I worry if policy-routing can make drop my router's performance. – Muhammad Resna Rizki Pratama Aug 1 '11 at 3:15
@qwildz: It probably varies from router to router, but enabling policy-routing tends to drop from CEF to slower forwarding algorithms. On low-end hardware, it tends to end up being CPU-switched. – Vatine Aug 1 '11 at 15:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.