Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there anyway to force computers to use a specific DNS? Even if a computer has a defined a DNS address that I don't want, all of its DNS traffic from it will be resolved using the specific DNS. I guess I'm trying to say is there a way to emulate a proxy so to speak with out making one.

The whole reason why I'm doing this is that I use OpenDNS for web filtering but the only thing that you need to do to bypass that is just type in a different DNS server in Windows.

One idea could be to somehow use a Captive portal to stop web traffic until the user has the correct DNS server. I don't know how to use a captive portal to check a DNS setting though...

Any ideas would be great. Thanks.

share|improve this question
add comment

6 Answers 6

up vote 8 down vote accepted

If you want you computers on your LAN to only permitted to use a specific DNS server you need to block UDP port 53 outgoing on your firewall to all IP addresses along with adding rules to explicitly permit the IPs of the "allowed" DNS servers.

If your users want to get around that they'll just run a VPN tunnel to an off-site box and get DNS from there. You can try and block that, too, but they'll just fight you another way. (After all, you can tunnel IP over DNS if you really want to! Heh heh...)

Your efforts aren't pointless, but you will have to fight an arms race that, by definition, no one can possibly win, if you want to stop everybody. Blocking DNS queries to J. Random DNS server will stop the average person.

share|improve this answer
    
Alright thanks guys I will try this out. :) I guess I need to read up on the common ports and see what they do. –  Austin Harsh Aug 8 '09 at 15:58
add comment

If it's an option for you, only a member of the administrator group can change a network adapter settings. Assign the DNS address by DHCP and make them a standard user and you should be ok.

share|improve this answer
add comment

If you are looking to prevent users on your network from some other dns server you will need to block access at the firewall. If you do that you will need to provide a dns server that you allow to have outside access. Any dns server can be used to proxy dns requests.

Some like dnsmasq are designed for the task. M0n0wall uses it for exactly that reason.

It wont stop everyone but it will allow you better control.

share|improve this answer
add comment

You need to block DNS (port 53) from all servers except the one you intend to use.

Easiest solution I can think of would be to install something like IPCop, SmoothWall, Monowall, pfSense (all FREE) on a spare PC (very low system requirements) and run an actual PROXY.

That's essentially what you're wanting to do... emulate a proxy without making one. ;-)

Installing something like IPCop is pretty painless, has Squid proxy built in, you can add URLFilter for free, then run the whole thing as a transparent proxy. Problem solved.

But all that aside... what you're looking to do is block port 53 to all IPs except for the OpenDNS servers.

As Evan mentioned, its not going to make it IMPOSSIBLE... but its going to keep the majority out. ;-)

Hope this helps.

share|improve this answer
    
I will try out those apps. Thanks. –  Austin Harsh Aug 8 '09 at 16:38
add comment

Within your LAN you could put up a DHCP serving the DNS you want. All DHCP enabled clients would go with yours. If there is already a DHCP server out there, just make sure you answer quicker, or do some ARP poisoning/spoofing.

share|improve this answer
add comment

I think this is what I'm going to do, I already have tomato firmware on my linksys router so I'm going to set the DDNS to opendns and then check the box that says intercept DNS port udp 53. I think that should work.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.