Re: Relay to DNS Server ?

[Mark Anacker <manacker@lot66.com>]

Antony Stone wrote:
> On Wednesday 16 June 2004 2:53 pm, Patrick Leslie Polzer wrote:
> 
> 
>>On Wed, 16 Jun 2004 15:31:37 +0200
>>
>>Akao <technique@akao.fr> wrote:
>>
>>>Is it possible to use netfilter rules to "relay" clients DNS requests ?
>>
>>Masquerading does that, but you must allow packets to port 53 tcp/udp to
>>pass through to your ISP's DNS servers and their related packets back.
> 
> 
> This is a completely correct and accurate answer to your question, however I 
> think you would get much better performance for very little effort if you set 
> up a simple caching-only name server somewhere on your network (possibly even 
> on the firewall itself, but don't tell anyone I suggested that :)
> 
> Regards,
> 
> Antony.
> 

You might want to run a DNS cache like dnsmasq on the firewall box, then 
use a REDIRECT or DNAT rule to grab client's requests and force them 
into the cache.  That way, the client's don't have to change their DNS 
server list, and you get the benefits of caching.

-- 
Mark Anacker
Chameleon Technology, Inc.