I look after a bunch of remote offices that connect via VPN - a Cisco ASA 5505 in each office acts as Firewall and VPN end point.

Beyond that we keep things as simple as possible in the offices to minimise the support burden. We don't have any kind of server except in offices large enough to justify having someone dedicated to IT. Basically there is the ASA, some computers, a network printer and a switch.

One of the problems I am seeing in a lot of offices is that DNS requests looking up hosts inside our network often fail - I'm assuming timeouts due to the offices internet connection (they are all in developing world countries) having some sub-optimal qualities (e.g. high latency caused by VSAT segments, or packet loss.

The obvious solution to this is to have some sort of local DNS service that can serve local requests - so I think it would need to do zone transfers from our Microsoft Windows 2008 R2 DNS servers at HQ. However, simply installing Windows Servers in each office is both expensive, and creates a support burden. This got me thinking about pfsense/m0n0wall on embedded devices - those can act as a DNS server, and could be configured at HQ and sent out as just something that needs to be plugged into the network and can then be forgotten about by the staff locally. Maybe there are some alternatives to the ASA 5505 that include some DNS functionality.

Has anyone here dealt with the problem, either using some kind of embedded device, or found some other solution? Any gotchas or reasons to avoid what I have suggested?


Two things:

  1. If the internet connection is sketchy what good is having a local DNS server if all they'll be able to do is use it to resolve DNS for external resources (web sites). If they can't access HQ resources because of the sketchy internet connection then I don't see any point to being able to browse the internet, unless they need to do that for their jobs.

  2. If these remote computers are joined to an AD domain then using any DNS servers other than the DNS servers that support that AD domain isn't a good idea and definitely goes against best practice.

| improve this answer | |
  • Internet connections all over the world are subject to outages - that is the case in the US but more common in the developing world where I work. If we lived in a perfect world we wouldn't need any redundant systems. I am trying to find a solution where DNS lookups by remote clients do not fail as frequently - that could be by putting some form of local DNS in, or something else. Unfortunately I don't have the luxury of buying a perfect Internet Connection in say Burundi - welcome to my world... – dunxd Nov 19 '12 at 11:19
  • You're missing my point. If the internet connection is down in the remote location then what good is it to have a local DNS server? – joeqwerty Nov 19 '12 at 15:23
  • One problem is outages, but that is not really the issue here. I suspect that DNS is failing due to timeouts caused by most of the remote locations showing the problem being on higher latency connections. Having a local DNS service would eliminate that as an issue for clients. Whether the latency, or other network condition, would cause a problem for zone transfers is something I don't know. Maybe a good answer to the question might address this. – dunxd Nov 20 '12 at 10:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.