0

I have a Linux VM which is connected to 2 different virtual networks. Say IP-1 (in vnet-1) = 192.168.0.5/24 and IP-2 (in vnet-2) = 172.16.0.6/24. I have a DNS server (say 10.0.0.10) which returns different results based on source IP. Eg: If I search for "nginx-service" using IP-1 as source IP, I will get result for service in vnet-1 And if I search for "nginx-service" using IP-2 as source IP, I will get result for service in vnet-2.

I have some services in vnet-1, and some in vnet-2. So I want to conditionally query some domains via IP-1 and some via IP-2 (the list is fixed). Is there any way to accomplish this with existing resolvers?

I can potentially write my own DNS resolver which constructs dns query with correct source IP based on the domain to resolve. But it would be preferable if an existing resolver like coredns, or dnsmasq has this ability. I know that dig allows you o specify source IP using -b option.

2
  • You can send a request with any source IP, but the reply will be sent to that IP, so it must have a valid route for you to receive it.
    – stark
    Dec 10, 2022 at 14:12
  • @stark Yes, both IPs can reach the DNS. But I am looking for out-of-box DNS resolvers that allow specifying source IP. Dec 11, 2022 at 7:58

2 Answers 2

1

Even if you didn't find any DNS Server that supports such thing, you always can do this:

You can run 2 DNS Servers on different ports and then Hijack the DNS queries in your firewall and Port Forward to the desired DNS Server's port based on the source IP address/range.

In nftables you can do this:

table ip nat {
  map ip2port {
    type ipv4_addr: inet_service;
    flags interval;
    elements = {
      192.168.0.0/24: 53,
      172.16.0.0/24:  5353
    }
  }

  chain prerouting {
    type nat hook prerouting priority -100;

    ip protocol { udp, tcp } th dport 53 redirect to ip saddr map @ip2port;
  }
}

In this example if the DNS request is from vnet-1, then the DNS server on port 53 is used and if it's from vnet-2 then the DNS Server on port 5353 is used.

0

You can either construct your own request packet and send to 10.0.0.10, or:

  • set route to 10.0.0.10 through the desired interface
  • send normal DNS request

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .