1

My goal is to forward DNS requests for certain work-related hosts to a jump server, which is able to resolve those requests.

I mapped port 53 on the jump server with 5353 locally as following:

ssh -L 5353:localhost:53 pritzl@jump

In this session, I am able to nslookup server.work. Now I want to be able to do the same on my machine at home.

I configured dnsmasq.conf in /etc/NetworkManager/dnsmasq.d/dnsmasq.conf as following:

server=/google.com/1.1.1.1
server=/server.work/127.0.0.1#5353

Then, I restarted network manager: service network-manager restart.

Now, let's test:

  • For google.com, I get:
pritzl@pritzl-vault:~$ nslookup google.com
Server:     127.0.1.1
Address:    127.0.1.1#53

Non-authoritative answer:
Name:   google.com
Address: 172.217.17.78
  • For server.work, I get:
pritzl@pritzl-vault:~$ nslookup server.work
;; connection timed out; no servers could be reached
  • For server-2.work, I immediately get:
pritzl@pritzl-vault:~$ nslookup server-2.work
Server:     127.0.1.1
Address:    127.0.1.1#53

** server can't find server-2.work: NXDOMAIN

(Regarding the latter, I guess this makes sense, as my ISP's DNS doesn't know server-2.work, and can response immediately. I guess I should alter my dnsmasq.conf to include everything from *.work, but it's a good test here to be restrictive.)

Something is wrong, but I don't know what. How do I continue with this?

additional information

I also tried setting server=/google.com/127.0.0.1#5353 in dnsmsaq.conf, and then nslookup google.com doesn't work anymore (besides the conclusion that nothing works, just not only work-related hosts). I am not sure what this means exactly, but I thought it was an interesting test to add here.

0

From man ssh:

-L local_socket:remote_socket
         Specifies that connections to the given TCP port or Unix socket
         on the local (client) host are to be forwarded to the given host
         and port, or Unix socket, on the remote side.

DNS commonly uses UDP, not TCP. Whilst TCP can be used, and dnsmasq has limited support for this, it's not given that your remote DNS server supports (or are configured) for this.

| improve this answer | |
  • Well...that makes sense, now. Thank you for pointing that out. I should probably open a new question for this, but my question then is how I should approach this instead? As said, I want to forward DNS requests for specific work hosts to the DNS server of a jump server. I actually came from here: superuser.com/questions/1456720/… (this question was asked by myself as well). – Pritzl Jul 7 '19 at 18:40
  • It depends. One way would be to use a VPN capable of transporting UDP, for instance OpenVPN. As you only transport queries, not the requests for the target services to the jump box, would it be possible to use externally visible DNS? Or use a VPN for everything for remote work? – vidarlo Jul 7 '19 at 18:43
  • I can see your concerns, regarding just DNS and the usage of OpenVPN. I'll open a new question with more context. I'm learning step by step, so bear with me. – Pritzl Jul 7 '19 at 18:46
  • I would suggest discussing this with whoever you're performing the work for. They probably have a setup for remote work. If not, thread carefully. For my workplace, using non-standard remote access would be grounds of termination. – vidarlo Jul 7 '19 at 18:58
  • Good idea, I did not realize that. I will contact them. For what it is worth, I got it working. I did not realize DNS goes over UDP, so thank you for explaining that. – Pritzl Jul 8 '19 at 5:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.