I have a bit of a technical dilema, and my brain has now frozen.

I've currently got an internal DNS server setup, with a fair few FQDNs for local servers etc, which is then set to forward to OpenDNS. OpenDNS is setup so that it filters our web traffic, and this works very well.

I've also setup a rule on the router, so that any DNS requests, are always forwarded to the internal DNS, regardless of what IP they requested to go to, so that none of the users can get round the filtering by specifying Google DNS etc.

We've just moved onto a new ISP, and have been given multiple public IPs. I need to give certain users unfiltered internet access, and so I thought I'd do this by mapping them to one of the other IPs, then relaxing the OpenDNS rules on this other IP.

Problem is, all of the DNS traffic is coming from the DNS server, and so everything is still filtered. If I run nslookup to myip.opendns.com, from my PC which has a different external address, it's returning the same address as the DNS server is mapped to (obvious when you think about it)

I could just unblock Google DNS for a single subnet, manually bind the IPs of the users into this new subnet, and then let them use the unfiltered net, but this means that none of the internal addresses then resolve.

I'm hoping that there is a way on DNS on Server 2003 to setup the forwards with a bit more detail, so that requests from one subnet get forwarded to OpenDNS and are filtered, and requests from this other subnet go to Google so they are unrestricted.

Anyone with any ideas on this? I've spent a fair few hours googling this, but don't seem to be getting anywhere. :(

I think you are going to have to solve this with a separate DNS server for the 'unfiltered clients' and policing access to that service either on the network or with a host firewall (or both).

The 'unfiltered' DNS server config could be fairly noddy - forwarding to your existing server for internal domains and forwarding to google (or opendns via second IP) for everything else.

A DNS proxy really.

A similar solution would be to load balance to DNS instances based on source IP, but even then you are going to have 2 DNS instances.

Yeah that's exactly what I was trying to avoid.

Our current virtual server is pretty much full to capacity, and so is the rack, so no more room for another physical server.

Hmm, a bit of rejigging is probably required.

What are you trying to achieve with the split horizon dns ? Sounds like an overly complicated solution.

I'm assuming from your description you have internal servers with fqdns using an externally hosted name space ? Are you fudging dns so people can't use the internet ?

Of course the real way to solve this as a whole issue is a web proxy server.

What are you trying to achieve with the split horizon dns ? Sounds like an overly complicated solution.

I'm assuming from your description you have internal servers with fqdns using an externally hosted name space ? Are you fudging dns so people can't use the internet ?

The servers are purely internal. If users connect remotely, they do by VPN. None of them are hosted namespaces.

We've basically got it setup so that requests for DNS on any external IP, get forwarded to the internal DNS server, so that even if the user overrides their settings, it makes no difference.

Of course the real way to solve this as a whole issue is a web proxy server.

A proxy server is something that I did look into before setting this up, but the cost of anything decent looking was prohibitive.

I'm not that fussed whether we carry on using OpenDNS, it's just that it's free, took very little setup, and is continually updated.

I'm hoping that there is a way on DNS on Server 2003 to setup the forwards with a bit more detail, so that requests from one subnet get forwarded to OpenDNS and are filtered, and requests from this other subnet go to Google so they are unrestricted.

If I've understood what you're trying to achieve correctly, I believe you can do this using views and forwarders in BIND. This does involve running BIND though...

If I've understood what you're trying to achieve correctly, I believe you can do this using views and forwarders in BIND. This does involve running BIND though...

Ahh excellent. I shall have to swat up on BIND then.

A proxy server is something that I did look into before setting this up, but the cost of anything decent looking was prohibitive.

Use squid, it can link into AD and you can filter what bits of the internet your users can get to. Squid is free :-) Force all uses to use a proxy.pac which points to your squid box. iirc, this can be done via DHCP, or via a group policy, and if your users decide to remove the proxy.pac then they lose the ability to browse the internet, assuming your don't push out the default gateway address of your router.

You will need to learn how to write a proxy.pac file. In a windows environment it is normally easiest to host it on a iis machine (using host headers is fine), with an internal DNS entry of wpad (iirc)

Unfiltered "web page" access, or pure internet (all ports, all protocols?)

Edited 22 September, 201015 yr by mbames

Ahhh more good stuff to melt my brain

Cheers for the info guys. This looks a lot more complex than I first thought it would be.

Dont think of it as adding complexity, think of it as preventing a mire of workarounds and disperse and interdependent configuration (which is inherently hard to maintain & manage).

Dont think of it as adding complexity, think of it as preventing a mire of workarounds and disperse and interdependent configuration (which is inherently hard to maintain & manage).

Haha there are already enough workarounds and bodges to keep me employed for a while to come

Haha there are already enough workarounds and bodges to keep me employed for a while to come

Or one of us employed if you want to contract the job out

I would just use something like what was ISA server and direct everyones web browser at that using the proxy settings. You can do this easily using an active directory GPO, or modify the default domain policy. Then simply apply the browsing rules using AD groups to define who can access what. Much easier, albeit more costly to do and you can host the ISA software on any current server. ISA is also a fully functioning cache, so can reduce the load on your internet connection by a suprising amount.