DNS server merging

Question

I have a router running, among other things, dnsmasq with standard setup, so I get DNS proxy plus additional local servers, plus name resolution for all machines whose IP address is managed via dnsmasq DHCP server.

Servers and other hosts are on my home.net domain

So far so good.

Now I need to connect via VPN to a customer site (customer.net) who has a very similar setup (they are not using dnsmasq, but net effect is the same).

I set up a small (virtual) machine acting as router forwarding (with NAT) from local network to IPSec tun device and added a few static routes to the (2) hosts needing to see customer.net; I did this manually instead of pushing the routes through dnsmasq.

Also this seems to work without problems.

Now I have the last problem I don't know how to solve:

I can access machines in customer.net private address space only specifying the IP address, no DNS resolution is available from dns.customer.net

How can I access dns.customer.net without losing connection with dns.home.net?

NOTE: I can modify my home.net setup (I would prefer to limit changes to the few hosts actually involved), but I have no control on customer.net

Situation I would like to have is:

• *.home.net addresses should be resolved by dnsmasq
• Internet routable addresses should be resolved by dnsmasq proxying my ISP DNS.
• *.customer.net addresses should be resolved by dns.customer.net (I can access this host via its non-routable IP), possibly without going through my dnsmasq

Is this at all possible? If so, how?

Answer 1

After a bit of investigation I found out dnsmasq can do what I need.

Here comes an excerpt from standard documentation (Dnsmasq setup):

Using special servers.

Dnsmasq has the ability to direct DNS queries for certain domains to specific upstream nameservers. This feature was added for use with VPNs but it is fully general. The scenario is this: you have a standard internet connection via an ISP, and dnsmasq is configured to forward queries to the ISP's nameservers, then you make a VPN connection into your companies network, giving access to hosts inside the company firewall. You have access, but since many of the internal hosts aren't visible on the public internet, your company doesn't publish them to the public DNS and you can't get their IP address from the ISP nameservers. The solution is to use the companies nameserver for private domains within the company, and dnsmasq allows this. Assuming that internal company machines are all in the domain internal.myco.com and the companies nameserver is at 192.168.10.1 then the option server=/internal.myco.com/192.168.10.1 will direct all queries in the internal domain to the correct nameserver. You can specify more than one domain in each server option. If there is more than one nameserver just include as many server options as is needed to specify them all.

In the end I added both DNS "special server" and additional static routes to my main dnsmasq (on my firewall) and everything works as needed as soon as the VPN Virtual Machine is up-and-running.

Actual lines added to my dnsmasq.conf are:

server=/customer.net/192.168.20.253
dhcp-option=121,192.168.2.0/24,192.168.7.11,192.168.20.0/24,192.168.7.11

I hope this helps someone to cut the chase.