Split DNS on Cisco IOS
At home I have a Cisco 867VAE router that acts as the gateway between my home network and the Internet. It also provides site-to-site VPN between my home network and services I have inside the Amazon Web Services (AWS) cloud.
For a while now I’ve been providing DNS resolution using a BIND DNS server running on a home server as I had a requirement to send DNS resolution requests to different upstream resolvers based on the domain and at the time of implementation the router I had didn’t have this capability.
As I have however had the Cisco router for a while I’ve decided it’s time to enable DNS resolution in the Cisco router and move this service here.
Here’s how I’ve done this.
The first step is to configure the default resolvers on the router. You might already have these in place especially if your router is already in use.
I use Google Public DNS so here’s my configuration:
ip name-server 184.108.40.206 ip name-server 220.127.116.11
This step involves configuring your DNS views. DNS views determine the resolvers that will be used.
In this case I have two views - one for domains I’m pointing to Unblock-Us and another for all other requests.
ip dns view default dns forwarder 18.104.22.168 dns forwarder 22.214.171.124 ip dns view unblockus dns forwarder 126.96.36.199 dns forwarder 188.8.131.52
Obviously you need to change the DNS view to suit your environment.
This step involves configuring the domains that you want to use your non-default DNS view. For example, a basic configuration that forwards Netflix to Unblock-Us is as follows:
ip dns name-list 1 permit .*.NETFLIX.COM ip dns name-list 1 permit .*.UNBLOCK-US.COM ip dns name-list 1 permit .*.US-WEST-9.ELB.AMAZONAWS.COM
If you have configured extra DNS views above then you’ll need to extra DNS name-lists by incrementing the ID.
This step involves configuring a DNS view-list that forwards requests based on the name list above. Anything that doesn’t match a name list is forwarded to the default.
ip dns view-list primary view unblockus 10 restrict name-group 1 view default 100
The last step is setting your router to use the view-list defined above and activating the DNS service.
ip dns server view-group primary ip dns server
You’ll need to adjust the above to suit your environment but once done you should have split DNS!