Network Layer 7 Deep Packet Inspection linux solution that isn't a all-in-one distro?

Question

Overview:

I have software that has our Edge/DNS servers hardcoded into them, DNS queries returned from DNS servers are not being masked properly. I need the DNS entries that are returned from BIND query requests to be masked with the originating server that has requested the query and not the DNS servers IP. The reason for why I want the masking is so that if an attacker were to get ahold of one of my edge server IP's and DDoS it, they would not be able to get ahold of the other servers IPs and DDoS or attack them as well.

The diagram below illustrates a simple version of what I'm trying to accomplish.

There are two types of ways the users can connect:

• Directly to the edge server IP that is provided to them/hardcoded in

OR

• Directly connect to their edge server assigned, and then via a web interface they select which office/server to connect to which on the backend does a iptables REDIRECT on their edge server which goes over a VPN tunnel.

Problem:

Sequence of events:

1. User2 connects to their edge server(server2)
2. edge server2 redirects their query to edge server1
3. edge server1 returns back to edge server2 the query response with edge server1's IP embedded in the DNS packet.
4. User gets hidden edge server IP that they should not know of.

Core problem:

Edge server's IP is embedded in the DNS response packet and needs to be masked to the original edge servers IP that the User is connected to

DNS Lookup example output:

• User2 queries for google.ca
• DNS Server1 processes the query and returns the result of it's own IP and not google's IP.

Lookup request(wrong):

nslookup google.ca
Server:  UnKnown
Address:  2.2.2.2
Name:    google.ca
Address:  1.1.1.1

Lookup Request that should be showing:

nslookup google.ca
Server:  UnKnown
Address:  2.2.2.2
Name:    google.ca
Address:  2.2.2.2

Below is a large scaled version of the network/system that is built.

Offices can have one or more servers in them depending on how many users.

(This is just illustrated to give you an idea of how it needs to scale)

What I've tried:

• iptables pre/post routing(didn't mask)
• Played with BIND configuration(altered the db.override file to return the servers IP) which worked but would require an individual server per edge server due to this file not being able to be real-time updated.

Potential Solutions Theory:

• Layer 7 solution that can alter the DNS query results IP, whether its a firewall or a sniffer/injection script that forces particular queries to show the original edge servers IP.