0

I'm running DNS and DHCP server on debian 8 server within local network.
Issue is that clients get nameservers by DHCP server in wrong/not desired order.

DHCP server config:

subnet 192.168.10.0 netmask 255.255.255.0 {  
option routers 192.168.10.1;  
option subnet-mask 255.255.255.0;  
option domain-name-servers 192.168.10.1, 8.8.8.8, 8.8.4.4;  
option time-offset -18000;    
default-lease-time 21600;  
max-lease-time 43200;  
}  

Where 192.168.10.1 is DNS and DHCP server.

Nameservers listed for local interface on client:

IP4.DNS[1]:                             8.8.8.8  
IP4.DNS[2]:                             8.8.4.4  
IP4.DNS[3]:                             192.168.10.1 

Client is Ubuntu 17.10 with isc-dhcp-client

EDIT: Content of /etc/dhcp/dhclient.conf

send host-name = gethostname();
request subnet-mask, broadcast-address, time-offset, routers,
    domain-name, domain-name-servers, domain-search, host-name,
    dhcp6.name-servers, dhcp6.domain-search, dhcp6.fqdn, dhcp6.sntp-servers,
    netbios-name-servers, netbios-scope, interface-mtu,
    rfc3442-classless-static-routes, ntp-servers;

How to get nameservers in proper order from DHCP server?
Desired order is to have local name server used first.
Ergo:

IP4.DNS[1]:                             192.168.10.1   
IP4.DNS[2]:                             8.8.8.8  
IP4.DNS[3]:                             8.8.4.4
  • Please add to the question what daemon are you using as DHCP client on Ubuntu side. – Rui F Ribeiro Jan 15 '18 at 14:40
  • It's isc-dhcp-client ... added! – Petr Jan 16 '18 at 10:30
  • @Fox It's Done! – Petr Jan 16 '18 at 15:32
  • The request field of dhclient.conf looks good. Are you sure there are no overrides in the network profile itself? I'm not sure where Ubuntu stores these, but if you configured the network in a GUI there should be a way to view such options – Fox Jan 18 '18 at 19:36
3

Rather than attempt to control the order of DNS servers on the client, it would be cleaner to advertise only the internal DNS server(s). This is possible if the internal servers are configured to forward requests that they cannot fulfill to a given set of public DNS servers.

For instance, my BIND9 configuration (on IP 192.168.2.1) contains

options {
    ...
    forwarders {
        208.67.220.220;
        208.67.222.222;
        8.8.8.8;
        8.8.4.4;
    }
    ...
}

Alternatively (thanks @RuiFRibeiro), you can use a zone block to communicate with the root nameservers:

zone "." IN {
    type hint;
    file "root.hint"
}

(where your distribution may use db.root instead of root.hint).

In either configuration, if the server cannot determine an IP for a requested name, it tries to contact another server, be that the servers defined in forwarders or the root nameservers, to find the appropriate IP. In other words, the local server is always tried first, and if it fails, a different server is used as a substitute.

The dhcpd.conf option is then simply

option domain-name-servers 192.168.2.1;

If you configure multiple redundant local DNS servers, each can be specified in the dhcpd configuration without worrying about their order, as they will all act the same.

  • +1 The advice is good. Why would you restrict yourself to forwarders, and not talking with the root nameservers? I also advise 2 internal DNS servers. – Rui F Ribeiro Jan 15 '18 at 18:27
  • Forwarders are simple, easy to configure. If you'd like to note in your answer (or leave a link if we've already got it here) how to configure direct communication to the root servers, that would be a good option too. I might even convert. As for redundant servers, that is always nice. In that case though, all servers can be supplied through dhcpd without regard for order, so it is a trivial change – Fox Jan 15 '18 at 18:49
  • Usually the sample configurations come using the root name servers. zone "." IN { type hint; file "root.hint"; }; - root.hint also is known as db.root – Rui F Ribeiro Jan 15 '18 at 19:22
  • 1
    Thanks for the tip! I've merged things from this comments section into the answer – Fox Jan 15 '18 at 19:33
  • Thanks, answer make a sence. I'm still wandering about ordering servers. For example when I'll have two DNS servers in network I want one to be used as primary so order can be still important. Issue appears only on my client Ubuntu 17.10 all other clients (ubuntu<17.xx, MS stations) are ok. – Petr Jan 16 '18 at 10:28
3

I would not be surprised of some client DHCP daemon optimisation delivering DNS servers with public IP addresses first.

However, given your insistence on order:

I do no recommend relying on DNS answer order for giving different DNS views or answers.

Leaving those kind of decisions for your clients in your local infra-structure can lead to some unpredictable behaviours at the least time you need those problems, not least taking into account negative DNS caching. It will also lead to greater DNS traffic. You also end up loading DNS servers up the hierarchy with questions about your internal domains.

I would recommend designing a well thought DNS infra-structure, either with Internet and internal dedicated servers, or using views, and with at least two internal DNS servers.

TLDR Delivering via DHCP several DNS servers with different views of the "world" does not brings more stability to the service, quite by the contrary.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.