Is it possible to send different-per-subnet DNSes from the single ISC DHCP server

domain-name-systemisc-dhcpsubnetvlan

The case I want to cover is to send different DNS server for one, isolated VLAN, which purpose is to give internet-only access – for our guests. It has no access to our internal network, so it shouldn't use DNS referring to internal addresses.

The problem, that is caused by setting that DNS is, that, if our employers are up to use that guest-only VLAN for some reason, they have no access to our mail server, as it tries to connect via internal address, which is not reachable from that subnet.

Example:

Guest only VLAN is 1000, subnet provided there via DHCP is 192.168.1.0/26,
traffic is limited to that subnet and to internet only,
that DHCP server has also pools 192.168.1.128/25, 192.168.2.0/23 and 192.168.4.0/22,
which are getting DNS servers from 192.168.1.64/26, but for the 192.168.1.0/26 subnet
I'd like to provide google DNSes: 8.8.8.8 and 8.8.4.4

Is such configuration possible at single DHCP server – the 'per subnet dns' configuration?
If not, is it possible to run 2 instances of ISC DHCP server at single physical/virtual machine, with different configs(and how do I achieve that)?

Best Answer

Yes, it is possible. You can create multiple subnet entries and give each its own DNS config, something like this:

# guests
subnet 192.168.1.0 netmask 255.255.255.192 {
    option routers 192.168.1.1;
    option subnet-mask 255.255.255.192;
    option domain-name-servers 8.8.8.8 8.8.8.4;
    # other config statements here
}
# trusted
subnet 192.168.2.0 netmask 255.255.254.0 {
    option routers 192.168.2.1;
    option subnet-mask 255.255.254.0;
    option domain-name-servers 192.168.1.64;
    # other config statements here
}
 # trusted
subnet 192.168.4.0 netmask 255.255.252.0 {
    option routers 192.168.4.1;
    option subnet-mask 255.255.252.0;
    option domain-name-servers 192.168.1.64;
    # other config statements here
}

Related Solutions

DHCP helper with a single subnet and multiple scopes

Woah, there. What you're saying contradicts itself. You say "single subnet" in one point, but then "VLAN each site" in the second point. Then you say "the networks will NOT be routed". Are you sure you know what you're saying here?

Typically 802.1q VLANs are deployed in a one-to-one relationship with IP subnets. Each 802.1q VLAN acts as an independent Ethernet broadcast domain and, as such, broadcasts from one VLAN (like, say, a machine ARP'ing for another machine in the local subnet) won't be forwarded between the VLANs. Splitting a single IP subnet across multiple VLANs requires a "smart" bridge that can do proxy ARP.

How are you planning to get ARP to work between these various VLANs?

If you really want to eliminate "cross-site 'chatter'" then what you really want is a subnet for each physical location, a router at each location connected to the "MAN" to route traffic to the other locations, and "ip-helper" functionality in each router to forward DHCP requests from the various locations to the central DHCP server.

What it sounds like you don't want is a single big subnet with a bunch of bridges running proxy ARP, in my opinion. Your DHCP inquiry really, really speaks to an underlying desire (though you don't know it) to have per-location subnets with DHCP scopes for each.

To speak to your question specifically re: DHCP: A DHCP "scope" is a range of IP addresses and options that a DHCP server will "hand out". The DHCP server chooses the scope to choose an address based on either the network interface the request is received from (if it's a broadcast request) or the address of the DHCP relay agent (if it's a relayed request).

Some background: Best way to segment traffic, VLAN or subnet?

ISC DHCP Server listening on virtual interface

OK, I figured it out. If you have more than one IP address assigned to the same interface, then all the subnet declarations have to be grouped together into another declaration. For example, the Linux machine has 192.168.1.1 and 10.10.10.1 (both /24) IP's on eth0. Then a simple scope would be:

shared-network mynet {
  subnet 10.10.10.0 netmask 255.255.255.0 {
      range 10.10.10.5 10.10.10.250;
      allow unknown-clients;
  }

  subnet 192.168.1.0 netmask 255.255.255.0 {
     range 192.168.1.194 192.168.1.200;
     ignore unknown-clients;
  }
}

The shared-network {} has to be around both subnet declarations. Then when you start the dhcp server, it will say listening on mynet rather than an ip address.

Related Topic