Split DNS on Cisco IOS

At home I have a Cisco 867VAE router that acts as the gateway between my home network and the Internet. It also provides site-to-site VPN between my home network and services I have inside the Amazon Web Services (AWS) cloud.

For a while now I’ve been providing DNS resolution using a BIND DNS server running on a home server as I had a requirement to send DNS resolution requests to different upstream resolvers based on the domain and at the time of implementation the router I had didn’t have this capability.

As I have however had the Cisco router for a while I’ve decided it’s time to enable DNS resolution in the Cisco router and move this service here.

Here’s how I’ve done this.

Step One

The first step is to configure the default resolvers on the router. You might already have these in place especially if your router is already in use.

I use Google Public DNS so here’s my configuration:

ip name-server 8.8.8.8
ip name-server 8.8.4.4

Step Two

This step involves configuring your DNS views. DNS views determine the resolvers that will be used.

In this case I have two views - one for domains I’m pointing to Unblock-Us and another for all other requests.

ip dns view default
 dns forwarder 8.8.8.8
 dns forwarder 8.8.4.4
ip dns view unblockus
 dns forwarder 111.118.175.56
 dns forwarder 118.127.33.48

Obviously you need to change the DNS view to suit your environment.

Step Three

This step involves configuring the domains that you want to use your non-default DNS view. For example, a basic configuration that forwards Netflix to Unblock-Us is as follows:

ip dns name-list 1 permit .*.NETFLIX.COM
ip dns name-list 1 permit .*.UNBLOCK-US.COM
ip dns name-list 1 permit .*.US-WEST-9.ELB.AMAZONAWS.COM

If you have configured extra DNS views above then you’ll need to extra DNS name-lists by incrementing the ID.

Step Four

This step involves configuring a DNS view-list that forwards requests based on the name list above. Anything that doesn’t match a name list is forwarded to the default.

ip dns view-list primary
 view unblockus 10
  restrict name-group 1
 view default 100

Step Five

The last step is setting your router to use the view-list defined above and activating the DNS service.

ip dns server view-group primary
ip dns server

You’ll need to adjust the above to suit your environment but once done you should have split DNS!