DNS questions -- Linux and Windows

[VeeDubbs]

Hi All -

I have two DNS servers. Our Linux one is used for residence halls and gives out a bogus DNS to people until they've registered. And our Windows 2003 server runs our true DNS for everyone (including residence halls once the person has registered).

I'd like to setup the Linux server to allow people to go to certain sites (i.e., windowsupdate.com, symantec.com, mcafee.com, etc...) in order to get their machines patched prior to registration. I've tried doing stuff like:

zone "microsoft.com" {
        type forward; forwarders { 10.2.0.53; }; forward only;
};

Should that work properly?

Also, the 10.2.0.53 address you see is the true DNS server (Windows 2003 server). How do I go about making sure that it will accept forwarded DNS queries to it?

Thanks!

 

[XOR != OR]

That *should* work, given certain network characteristics, but I'm not sure i'd go about solving that problem via DNS. Captive portals typically block traffic at the network layer. Your solution implies that client devices have full access out, it's only DNS that's limiting their ability to access content. However, even the slightest amount of networking knowledge will allow a user to point their dns to 4.2.2.1 ( for instance ), and get whatever they want. More advanced users can set up their own DNS name caching server.

How I've seen it done in the past is that users are dropped in to an enclosed vlan which, by default, only allows access to certain sites ( via firewall, or some other edge security device ). Once the user has "registered", that port is dropped in to the "registered" vlan and they have full access from that point forward.

 

[VeeDubbs]

That *should* work, given certain network characteristics, but I'm not sure i'd go about solving that problem via DNS. Captive portals typically block traffic at the network layer. Your solution implies that client devices have full access out, it's only DNS that's limiting their ability to access content. However, even the slightest amount of networking knowledge will allow a user to point their dns to 4.2.2.1 ( for instance ), and get whatever they want. More advanced users can set up their own DNS name caching server.

How I've seen it done in the past is that users are dropped in to an enclosed vlan which, by default, only allows access to certain sites ( via firewall, or some other edge security device ). Once the user has "registered", that port is dropped in to the "registered" vlan and they have full access from that point forward.

You are correct, simply changing your DNS will get you around this. We're using a piece of software called Netreg to do this, and unfortunately we are stuck with it for another year or so due to budget constraints. We are planning on going to a full blown NAC solution in 2012 or 2013 which will do exactly as you specified.

However, we must work with what we have for right now. So, I believe I have the forwarded set up in the Linux DNS properly, but am curious how to make sure my Windows server is set to accept those forwards. Or does it accept it by default?

 

[XOR != OR]

Assuming the windows DNS is set to forward already, it's not really picking about the clients it services ( obl. dirty joke here ). So it should work fine.