149

I have a small home network that just got larger (new roommate, my existing roommate got a laptop (on top of her computer), my friends coming over with laptops, etc.).

I'd like to run a local DNS server for lookups of my local network stuff (fileserver.local, windowsTV.local, machineA.local, machineB.local, appletv.local). I used to have a business line with a static IP, and run bind/named internally. However, now I have a normal account.

My ISP's DNS servers are constantly changing (for whatever reasons my ISP doesn't like to keep the same IP range for long). I need my local DNS to be automatically updated to use my ISP's DNS for external traffic, but be able to maintain an internal DNS server (getting to update the hosts file is being a hassle with every new machine on top of rebuilding existing machines with win7 or Ubuntu 9.04).

Additionally, My ISP's DNS servers often crash or become unresponsive. Are there any open DNS servers that are reliable (I don't want to reconfig every day) that I could use as my primary, then if those fail, then use my ISP's?

UPDATE: Also looking for each workstation to be able to use dhcp to connect, but instead of getting ISP DNS servers, getting my internal one....

5
  • 3
    There are at least 2 questions here: Local DNS config, public DNS servers. Post 2 questions next time.
    – hyperslug
    Sep 23, 2009 at 19:09
  • 37
    I agree, but i'm looking for an overall solution. each question on it's own would have a correct answer, but may not mesh, i'm trying to look for solution to both problems that works together.
    – Roy Rico
    Sep 23, 2009 at 20:51
  • @RoyRico Did you ever find a good solution? I am trying to do the exat same thing witha Tomato router and am running into walls at every direction.
    – Jeff
    Dec 15, 2012 at 3:04
  • If you have a linux box, here is how to setup DNSMASq in details -- sfxpt.wordpress.com/2011/02/06/…
    – xpt
    Jun 15, 2014 at 23:29
  • The new Google DNS servers are 8.8.8.8 and 8.8.4.4 in case anyone was wondering...
    – Tmanok
    Feb 13, 2018 at 21:03

15 Answers 15

20

If you want internal fake domains to work you can't configure your workstations with any DNS servers except your own. Once you set up BIND it can work by itself and you don't need your ISP's or any other non-authoritative DNS servers at all.

5
  • 12
    However a good netizen will forward to their ISP's DNS caches if possible. The load on the root DNS servers is horrendous. Especially for small sites like this one, because it wouldn't scale if every household decided to go direct. (If you're worried about ISP tampering, use DNSSEC).
    – sourcejedi
    May 1, 2013 at 18:53
  • 3
    @sourcejedi, you misunderstand what a caching DNS server actually does.. it certainly doesn't pound on the root servers, it only bothers them maybe once a week.
    – milli
    Feb 12, 2014 at 5:31
  • 9
    There's a different reason why you should forward to your ISP DNS servers... you'll look like an ordinary client to them. If you don't and they see you have a system that's sending DNS queries all over the world, they're going to assume you're running a DNS server and might just throw a firewall rule in your face and hose you. You'll struggle to figure out what broke and probably waste hours trying to figure it out if/when that happens.
    – milli
    Feb 12, 2014 at 5:32
  • 1
    Further to @milli's point, your ISP's DNS may also override resolution of some domains to their private machines with faster/cached/unmetered content. Using public DNS can break those services or cost you more.
    – Walf
    May 19, 2017 at 3:03
  • @Walf they can also decide to ban certain content by blackholing it.
    – Chris_F
    Jul 7, 2022 at 1:12
122

Basically you need to run your own DHCP and DNS server. You're already running your own DHCP server if you have a typical router that gives out private IP addresses.

Your DHCP server must be configured to hand out your router IP as the gateway address, and your DNS server IP as the DNS server address, obviously.

Your DNS server must be configured to resolve a non-official top-level domain locally, such as .local, and then forward any other requests to another DNS. In BIND you need to add a forwarders { } section to your /etc/bind/named.conf.options, which contains the public DNS servers you want to use to resolve non-local addresses.

As other comments suggest, if you don't want to forward to your ISP's DNS servers, you could use OpenDNS, Google's public DNS servers, or 4.2.2.1/4.2.2.2 from Level 3.

If you are running your own DNS server, you need a box that will be on all the time, as all DNS queries on your home network will go through it. This box needs a fixed IP on your home subnet. Make sure it can't get bulldozed by DHCP, and the box itself should not be getting an IP via DHCP. If your DHCP is configured to hand out addresses from 192.168.1.1 to 192.168.1.100 for example, then give your DNS server the IP 192.168.1.101. In the usual situation of home routers you just need to simply tell the router that the DNS server is 192.168.1.101 and reboot.

If you can get a local DNS running on your broadband router, great, but a DNS server might benefit from lots of RAM for caching queries, depending on which DNS software you use. On my network I just use straight BIND. Sounds like you might have a little experience with that and for me it works great.

5
  • 4
    4.2.2.1/4.2.2.2/4.2.2.3 are from Layer 3.
    – Hengjie
    Nov 28, 2012 at 11:42
  • 1
    Excellent answer! Thanks for the complete, clear info. I'll try setting this up on my local network soon.
    – Form
    Sep 23, 2015 at 12:41
  • 3
    Success! This approach is sound. Setting a fixed IP outside of the addressable range / avoiding DHCP for the DNS box is especially relevant. Thanks!
    – Form
    Sep 25, 2015 at 0:57
  • @Hengjie what is Layer 3?
    – Jonathan
    Jan 4, 2018 at 21:05
  • Layer 3 is a datacenter provider as well as a network provider. They also happen to provide rock solid DNS servers.
    – Hengjie
    Jan 10, 2018 at 17:22
15

Are there any open DNS servers that are reliable

You said it: OpenDNS.

208.67.222.222
208.67.220.220
9
  • 4
    I would also look at aboutdebian.com/dns.htm for a good overview of the different ways you can setup your own dns server. Sep 23, 2009 at 19:04
  • 1
    +1 for OpenDNS. I use it both at work and at home. Fantastic service.
    – DWilliams
    Sep 24, 2009 at 0:19
  • 5
    Be careful that OpenDNS name servers are liars: they rewrite DNS responses, to direct you to an ad service or to censor some destinations.
    – bortzmeyer
    Sep 24, 2009 at 7:55
  • 12
    Google's public DNS servers at 8.8.8.8 and 8.8.4.4 are also pretty good.
    – LawrenceC
    Feb 16, 2011 at 14:30
  • 2
    Note that OpenDNS is now Cisco, and Cisco has strong ties to the NSA cisco.com/c/en/us/about/corporate-strategy-office/acquisitions/…
    – Jonathan
    Jan 4, 2018 at 21:07
7

Unbound is pretty easy, supports bind style config files and fairly reliable. If the server will be a stand-alone 'gateway' type box, and you'd like a few extra niceties, you might want to take a look at the firewall/gateway distro called untangle as well.

1
  • FYI runs on Windows.
    – jarmond
    Jun 13, 2020 at 16:45
6

If you are running Windows - you should take a look at Simple DNS Plus - it is a full DNS server that also comes with a DHCP server plug-in - and has an easy-to-use GUI.

[Note: the product is developed by the author of this post]

2
  • I'm running windows as one of my machines, but it's not always on. Linux machine is usually on.
    – Roy Rico
    Jan 25, 2011 at 1:31
  • 4
    Just mentioning this is not a free solution. 14-day trial and educational licensing is offerred. Otherwise you'll pulling dough somewhere between $70 > $300
    – CyberFox
    Mar 11, 2019 at 2:43
4

If you have a linux box then you'd want to setup DNSMASq got your local addresses and use it as a forwarding/caching DNS server for external addresses. This is also often what is used on linux distributions for home routers such as openwrt/ddwrt/tomato.

Alternately, on mostly Apple/Mac networks you'd be using Bonjour/Zeroconf which both Linux and Apple computers can communicate on for broadcast level DNS/service resolution.

That being said, on a purely hybrid network with all three OS running, you'll definately want a local DNS server with forwarding to either OpenDNS, GoogleDNS, or your local ISP DNS depending on your location/needs.

4

In terms of getting started quickly I ended up using a pihole deployment with extra lists, as described in https://www.youtube.com/watch?v=qNCzSA2bs9I

In this solution you get ad-block as "unnecessary" extra, but maybe it is more people than me who don't mind.

Start by installing pihole on some machine as described here https://github.com/pi-hole/pi-hole/#one-step-automated-install and get it up and running.

When you're finished with getting pihole to work, extend the pihole configuration as below (example on a debian system, with a .lan domain):

Create a file /etc/dnsmasq.d/02-lan.conf with content

addn-hosts=/etc/pihole/lan.list

Then create another file /etc/pihole/lan.list containing your local mappings, such as

192.168.1.100 nas.lan
192.168.1.101 somethingelse.lan

if you e.g. have a nas sitting at 192.168.1.100.

Conclude by restarting the piholes dns service using sudo pihole restartdns

Update June 2020

Version 5 of pihole seems to have a GUI feature for this in the admin panel, adding to /etc/pihole/custom.list See e.g.https://discourse.pi-hole.net/t/local-dns-records/31772

3

Some free DNS servers you can use for forwarding:

1.1.1.1 - Cloudflare
1.0.0.1 - Cloudflare
4.2.2.1 - Layer 3
4.2.2.2 - Layer 3
4.2.2.3 - Layer 3
8.8.8.8 - Google
8.8.4.4 - Google
208.67.222.222 - OpenDNS
208.67.220.220 - OpenDNS
1
  • And quad 9 is free as well: 9.9.9.9 Nov 27, 2020 at 23:15
2

4.2.2.1 & 4.2.2.2 are what I use

edit: that is, in regard to public servers. Easy to remember and I don't think I've seen them fail since I've been using them.

4
  • Iv'e seen those before. Who runs those? Are the public allowed to use them? how reliable are they?
    – Roy Rico
    Sep 23, 2009 at 18:46
  • Verizon. Seems like they don't care. Very.
    – hyperslug
    Sep 23, 2009 at 18:55
  • They are open DNS servers, free for public use. They are both fast and reliable.
    – Walter
    Mar 3, 2010 at 3:16
  • 3
    I have seen 4.2.2.2 fail enough for our customers (who require reliable DNS for credit card processing!) that I always change these to Google's Public DNS or OpenDNS whenever I see them. Changing away from Verizon's servers always clears this problem immediately. Mar 3, 2010 at 3:28
2

Any Broadband router delivers both DNS & DHCP services for the local network. If you want INcomming connections from internet to local machines you need a router that also supports DynDNS and Incomming PortForwarding.

If you pick one from the DD-wrt supported hardware list you can flash it with that Firmware and it will support any feature you could ever need in your small network.

1
  • 4
    I don't think that most broadband routers provide for DNS service, at least not with the provided firmware. Most just provide DHCP and use that to tell your systems to use your ISP's DNS servers. Now, if you flash on a 3rd party firmware like DD-WRT, OpenWRT, or Tomato, then they can provide DNS services as well.
    – afrazier
    Feb 16, 2011 at 15:00
2

For hostname resolution maybe mDNS/DNS-SD using avahi could solve the problem more easily:

Check if you already have the service running:

systemctl status avahi-daemon.service

If not, install avahi-daemon (service) and avahi-utils (avahi-browse command) packages. Once the hosts has the service and hostname set correctly:

avahi-browse --all --ignore-local --resolve --terminate

Related links

1

For running a DNS server on your LAN, take a look at 'pdnsd' which is a nameserver for *nix.

1

I had a similar problem. I bought an OpenWRT compatible router and installed OpenWRT. It offers static IP binding along with name resolution in the router, which enabled me to give names to my computers and devices in the network as I wish.

0

If you download the DNS benchmark program from link text, it will benchmark a list of public DNS servers as well as your local DNS server. After running this program, try putting a copy of the fastest servers into the DNS setting on your router and then renew your DHCP session and running the test again.

If your router allows it, add both the router and one of the fast external DNS servers to the list of DNS servers that it hands to DHCP client (but pick a different one from the one that you entered for the router DNS server addresses).

0

Maybe I'm saying something stupid. In this case I would simply add IP and names to the hosts files on the individual machines..

192.168.0.120 tv.local

192.168.0.80 studiopc.local

2
  • 1
    ok, how do you add them, stefano. _how
    – Nick
    Jun 4, 2020 at 2:12
  • 1
    This works fine where it works, but requires configuration for every device. Not only is that inconvenient, but some devices just won't let you do that. If I want to connect to my local media server from my smart TV, this isn't going to work.
    – Julian
    Sep 29, 2022 at 0:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .