nsDNS Guide
Overview of nsDNS
Netsweeper Supports DNS-based filtering with our nsDNS service. nsDNS is lightweight, easy to deploy and manage; and it has a very high-performance rate without the need tor Certificates of Authority to function.
Under the hood nsDNS uses PowerDNS Recursor, a well known, reliable DNS solution that is used by hundreds of millions of users globally.. PowerDNS is known to be able to handle thousands of concurrent DNS Requests, and also supports DNSSEC. For more information on PowerDNS Recursor, please see https://doc.powerdns.com/recursor/
nsDNS also provides dnsdist, which is developed by PowerDNS. Some of the main benefits of dnsdist are that it is proven to be a DOS- (Denial Of Service,) and abuse-aware load balancer; and its services integrate via LUA Script. For more information on dnsdist, please refer to https://dnsdist.org/.
nsDNS Inputs
Below is a list of inbound ports used by nsDNS
| Port | Protocol | Comments |
|---|---|---|
| 53 | DNS Dist | Default port for DNS Dist |
| 5300 | DNS Recursor | Default port for DNS Recursor |
nsDNS Outputs
Below is a list of outbound ports used by nsDNS
| Port | Protocol | Comments |
|---|---|---|
| 5300 | DNS Dist | Default outbound port for DNS Dist |
| 53 | DNS Recursor | Default outbound port for DNS Recursor |
Configuring nsDNS
nsDNS is configurable via SSH. In addition to the files mentioned in this document's 'Inputs' table, Netsweeper-specific configuration options can be accessed by navigating to:
/usr/loca/netsweeper/etc/pdns-recursor.conf
Our pDNS Recursor file supports the following configuration options:
Enable/Disable Netsweeper Integration
Enable or Disable the Netsweeper Policy Service integration. Change to true or false to enable/disable policy service filtering.
| Format | Default Setting |
|---|---|
| enabled = {true|false} | enabled = false |
Policy Server Address
The policy service to connect to, recommended to use 127.0.0.1.
| Format | Default Setting |
|---|---|
| policyServer = "ADDRESS" | policyServer = "127.0.0.1" |
DNS Time to Live
The DNS Time to Live for denied items. This will be cached by the workstation for the configured number of seconds, recommended to be a few seconds.
Longer TTLs can improve performance, but in cases where your deployment includes features like authentication portals or disable filtering links, it is likely desirable to use a shorter TTL.
| Format | Default Setting |
|---|---|
| denyTTL = seconds | denyTTL = 5 |
Default Time to Live
The time to live to adjust every DNS resolution to. If you have disable filtering, or have users changing policies, this may need to be lowered to a few seconds. However, the lower the number the higher the load on the system since workstations will not cache DNS results. This may also impact performance on systems with low bandwidth to the DNS server.
| Format | Default Setting |
|---|---|
| defaultTTL = seconds | defaultTTL = 3600 |
Scheme
The scheme to use for policy server events. If you are using DNS filtering with another filtering technology integrated to the same policy server, you will need to use the dns:// scheme. Otherwise, if the system is only performing DNS filtering, you may want to change this to http:// or https:// for better categorization and reporting. We recommend as of 6.1.4 to use the dns:// scheme by default.
| Format | Default Setting |
|---|---|
| defaultScheme = "http" | defaultScheme = "dns" |
DNS64
DNS64 can be enabled by adding the prefix and the in-arpa. Change these two settings to the magic you want. The dns64IPv6Only setting will not return the DNS64 translated address for an IPv4 client.
| Format | Default Setting |
|---|---|
| dns64Prefix = "fe80::21b:77ff:0:0" | dns64Prefix = "" |
| dns64ARPA = "f.f.7.7.b.1.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa." | dns64ARPA = "" |
| dns64IPv6Only = true | dns64IPv6Only = true |
EDNS
Use a specific EDNS field for the username of the request. For the MAC address, set the ednsClientNameFormat = "mac" to print the mac as a 01:02:03:04:05:06 format. The ednsClientNameFormat will return the value as a string otherwise.
nSDNS supports EDNS option 65001, which can provide user names. 65001 is an option for a custom field. For example,you can set 65001 as your MAC address.
| Format | Default Setting |
|---|---|
| ednsClientNameOption = "65001" | ednsClientNameOption = "65001" |
| ednsClientNameFormat = "" | ednsClientNameFormat = "mac" |
Monitoring nsDNS
Netsweeper has several MIBs that can be used to monitor nDNS. To acquire a list of list of DNS-related MIBs, run the following command:
snmpwalk -c public -v2c localhost:3161 NSD-MIB::nsd | grep dns
Troubleshooting
The following options can be used to troubleshoot nsDNS.
You can query your server locally with the dig command, as well as the nslookup command. Netsweeper will respond with 'qtype=1' in URL format, qtype=1 is the decimal equivalent of an A Record. For more information on this topic, please refer to https://en.wikipedia.org/wiki/List_of_DNS_record_types.