VyOS provides DNS infrastructure for small networks. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls, for this we utilize PowerDNS recursor.
VyOS DNS forwarder does not require an upstream DNS server. It can serve as a full recursive DNS server - but it can also forward queries to configurable upstream DNS servers. By not configuring any upstream DNS servers you also avoid to be tracked by the provider of your upstream DNS server.
Forward received queries for a particular domain (specified via domain-name) to a given name-server. Multiple nameservers can be specified. You can use this feature for a DNS split-horizon configuration.
This also works for reverse-lookup zones (
::/0would allow all IPv4 and IPv6 networks to query this server. This is on general a bad idea.
The PowerDNS Recursor has 5 different levels of DNSSEC processing, which can be set with the dnssec setting. In order from least to most processing, these are:
- off In this mode, no DNSSEC processing takes place. The recursor will not set the DNSSEC OK (DO) bit in the outgoing queries and will ignore the DO and AD bits in queries.
- process-no-validate In this mode the Recursor acts as a “security aware, non-validating” nameserver, meaning it will set the DO-bit on outgoing queries and will provide DNSSEC related RRsets (NSEC, RRSIG) to clients that ask for them (by means of a DO-bit in the query), except for zones provided through the auth-zones setting. It will not do any validation in this mode, not even when requested by the client.
- process When dnssec is set to process the behaviour is similar to process-no-validate. However, the recursor will try to validate the data if at least one of the DO or AD bits is set in the query; in that case, it will set the AD-bit in the response when the data is validated successfully, or send SERVFAIL when the validation comes up bogus.
- log-fail In this mode, the recursor will attempt to validate all data it retrieves from authoritative servers, regardless of the client’s DNSSEC desires, and will log the validation result. This mode can be used to determine the extra load and amount of possibly bogus answers before turning on full-blown validation. Responses to client queries are the same as with process.
- validate The highest mode of DNSSEC processing. In this mode, all queries will be validated and will be answered with a SERVFAIL in case of bogus data, regardless of the client’s request.
The famous UNIX/Linux
dig tool sets the AD-bit in the query.
This might lead to unexpected query results when testing. Set
dig commandline when this is the case.
CD-bit is honored correctly for process and validate. For
log-fail, failures will be logged too.
/etc/hostsfile in name resolution. VyOS DHCP server will use this file to add resolvers to assigned addresses.
Router with two interfaces eth0 (WAN link) and eth1 (LAN) does want to make use of DNS split-horizon for example.com.
- DNS request for example.com need to get forwarded to IPv4 address 192.0.2.254 and IPv6 address 2001:db8:cafe::1
- All other DNS requests are forwarded to DNS server listening on 192.0.2.1, 192.0.2.2, 2001:db8::1:ffff and 2001:db8::2:ffff
- DNS server is listening on the LAN interface addresses only, 192.168.1.254 for IPv4 and 2001:db8::ffff for IPv6
- Only clients from the LAN segment (192.168.1.0/24) are allowed to use this server
set service dns forwarding domain example.com server 192.0.2.254 set service dns forwarding domain example.com server 2001:db8:cafe::1 set service dns forwarding name-server 192.0.2.1 set service dns forwarding name-server 192.0.2.2 set service dns forwarding name-server 2001:db8::1:ffff set service dns forwarding name-server 2001:db8::2:ffff set service dns forwarding listen-address 192.168.1.254 set service dns forwarding listen-address 2001:db8::ffff set service dns forwarding allow-from 192.168.1.0/24 set service dns forwarding allow-from 2001:db8::/64