Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

I have a Windows Server 2008 server set up at my school and would like to set the DNS servers for the clients based on their IP address.

Reason:

We have faculty machines and a student lab and would like to use OpenDNS on the student machines but no on the faculty machines.

What is the best way to do this?

Thanks!

share|improve this question
3  
Perhaps a better solution would be to use a proxy server of some sort instead of trying to restrict and control internet access via DNS. – joeqwerty Sep 1 '11 at 16:28

2 Answers

up vote 4 down vote accepted

If these computers are in an active directory domain, they must point at the active directory DNS servers for client resolution. But on your DNS server you can setup forwarders so that requests for non-local records will be forwarded to an external DNS server.

AFAIK, there is no way to setup forwarders to select different servers based on the source IP, so you would need to have to setup an additional DNS server with your AD zones. Set the forwarders to OpenDNS on that server and point your clients at that.

As @joeqwerty mentioned an HTTP proxy would also be useful here. When the browser is configured to use the proxy (non-transparent) then the DNS requests will be resolved by the proxy server. So you could easily use a GPO, or WPAD to push a proxy setting, setup a basic proxy, and set your preferred DNS on the proxy server.

share|improve this answer
up vote 4 down vote

Sounds like the systems are in different subnets (otherwise, there'd be no way to tell them apart by IP address), correct?

If this is the case, modify your DHCP scope options for the different scopes to feed the student machines the OpenDNS configuration and the faculty machines the normal configuration.

share|improve this answer
Good in general, but it sure seems likely he has an AD Domain, pointing his clients directly at OpenDNS in that case will result in badness. If he doesn't have AD, this is will work great. – Zoredache Sep 1 '11 at 16:20
@Zoredache True - though, also likely to cause badness is OpenDNS's NXDOMAIN hijacking when used as a forwarder for an AD server, though.. breaks proper search suffix behavior for clients. – Shane Madden Sep 1 '11 at 16:23
1  
If he is paying for the enterprise level of OpenDNS the NXDOMAIN crap can be disabled according to this. opendns.com/support/article/76 – Zoredache Sep 1 '11 at 16:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.