Documentation
VyOS Documentation
VyOS Services
DNS Forwarding

DNS Forwarding

VyOS uses PowerDNS Recursor to provide a DNS forwarding service - lightweight DNS infrastructure for small and medium-sized networks.

Overview

DNS Forwarding allows you to:

  • Cache DNS queries to speed up name resolution
  • Forward queries to upstream DNS servers
  • Provide split-horizon DNS (different answers for different domains)
  • Act as a recursive DNS server
  • Host authoritative DNS zones

Basic Configuration

Minimal Setup

set service dns forwarding listen-address '192.168.1.1'
set service dns forwarding allow-from '192.168.1.0/24'
commit

This configuration:

  • Listens on address 192.168.1.1
  • Accepts queries from the 192.168.1.0/24 network
  • Uses the system DNS servers as upstream

Specifying Upstream DNS Servers

Explicitly specifying DNS servers:

set service dns forwarding listen-address '192.168.1.1'
set service dns forwarding allow-from '192.168.1.0/24'
set service dns forwarding name-server '8.8.8.8'
set service dns forwarding name-server '8.8.4.4'
commit

Using System DNS Servers

set service dns forwarding system
commit

This uses the DNS servers configured on the system (for example, obtained via DHCP on the WAN interface).

Using DNS from a DHCP Client

set service dns forwarding dhcp eth0
commit

The DNS server will use the nameservers obtained via DHCP on the eth0 interface.

Listen Address

The addresses on which the DNS server accepts queries:

Single address:

set service dns forwarding listen-address '192.168.1.1'

Multiple addresses:

set service dns forwarding listen-address '192.168.1.1'
set service dns forwarding listen-address '192.168.2.1'
set service dns forwarding listen-address '::1'

Listen on all interfaces (not recommended):

set service dns forwarding listen-address '0.0.0.0'

Access Control

Allow From

Allowing queries from specific networks:

set service dns forwarding allow-from '192.168.1.0/24'
set service dns forwarding allow-from '192.168.2.0/24'
set service dns forwarding allow-from '10.0.0.0/8'

By default, if not specified, only queries from localhost are allowed.

Ignore Hosts File

Ignoring the local /etc/hosts file:

set service dns forwarding ignore-hosts-file
commit

Domain-Specific Forwarding

Forwarding queries for specific domains to dedicated DNS servers.

Basic Example

Sending queries for the example.com domain to a corporate DNS server:

set service dns forwarding domain example.com name-server '192.168.100.1'
commit

Split-Horizon DNS

Different DNS servers for internal and external domains:

# Internal domains to the internal DNS
set service dns forwarding domain corp.local name-server '192.168.1.10'
set service dns forwarding domain internal.local name-server '192.168.1.10'

# External queries to public DNS
set service dns forwarding name-server '8.8.8.8'
set service dns forwarding name-server '1.1.1.1'

commit

Reverse DNS Zones

Forwarding reverse DNS zones:

set service dns forwarding domain 1.168.192.in-addr.arpa name-server '192.168.1.10'
set service dns forwarding domain 2.168.192.in-addr.arpa name-server '192.168.2.10'
commit

Recursive Lookups in Subdomains

Adding the addNTA option to bypass DNSSEC:

set service dns forwarding domain example.com addnta
commit

Caching

Cache Size

DNS cache size (number of records):

set service dns forwarding cache-size 10000
commit

Default: 10000 records.

For high-load networks:

set service dns forwarding cache-size 50000
commit

Negative TTL

The caching time for negative responses (NXDOMAIN):

set service dns forwarding negative-ttl 3600
commit

Value in seconds. Default: 3600 (1 hour).

DNSSEC

DNS Security Extensions for verifying the authenticity of DNS responses.

DNSSEC Modes

set service dns forwarding dnssec <mode>

Available modes:

  • off - DNSSEC disabled (default)
  • process-no-validate - process DNSSEC records but do not validate
  • process - process and validate
  • log-fail - log validation failures
  • validate - strict validation (reject invalid responses)

Recommended setting:

set service dns forwarding dnssec validate
commit

Authoritative Domains

Hosting your own DNS zones on VyOS.

Creating a Zone

set service dns forwarding authoritative-domain example.local
commit

Adding Records

A Record (IPv4)

set service dns forwarding authoritative-domain example.local records a server1 address '192.168.1.10'
set service dns forwarding authoritative-domain example.local records a server2 address '192.168.1.20'
commit

AAAA Record (IPv6)

set service dns forwarding authoritative-domain example.local records aaaa server1 address '2001:db8::10'
commit

CNAME Record (Alias)

set service dns forwarding authoritative-domain example.local records cname www target 'server1.example.local'
commit

MX Record (Mail)

set service dns forwarding authoritative-domain example.local records mx mail priority 10
set service dns forwarding authoritative-domain example.local records mx mail server 'mail.example.local'
commit

NS Record (Name Server)

set service dns forwarding authoritative-domain example.local records ns ns1 target 'dns1.example.local'
commit

PTR Record (Reverse DNS)

set service dns forwarding authoritative-domain 1.168.192.in-addr.arpa records ptr 10 target 'server1.example.local'
commit

TXT Record

set service dns forwarding authoritative-domain example.local records txt spf value 'v=spf1 mx ~all'
commit

SRV Record (Service)

set service dns forwarding authoritative-domain example.local records srv _ldap._tcp entry 0
set service dns forwarding authoritative-domain example.local records srv _ldap._tcp entry 0 hostname 'ldap.example.local'
set service dns forwarding authoritative-domain example.local records srv _ldap._tcp entry 0 port 389
set service dns forwarding authoritative-domain example.local records srv _ldap._tcp entry 0 priority 10
set service dns forwarding authoritative-domain example.local records srv _ldap._tcp entry 0 weight 100
commit

Performance and Timeouts

Timeout

Timeout for DNS queries (milliseconds):

set service dns forwarding timeout 1500
commit

Default: 1500ms.

Max Cache Entries

Maximum number of cached records:

set service dns forwarding max-cache-entries 100000
commit

Configuration Examples

Home Network

# Basic setup
set service dns forwarding listen-address '192.168.1.1'
set service dns forwarding allow-from '192.168.1.0/24'

# Public DNS servers
set service dns forwarding name-server '8.8.8.8'
set service dns forwarding name-server '1.1.1.1'

# Cache
set service dns forwarding cache-size 10000

commit

Corporate Network with Split-Horizon

# Listen on the management interface
set service dns forwarding listen-address '192.168.10.1'
set service dns forwarding allow-from '192.168.0.0/16'

# Internal domains to the corporate DNS
set service dns forwarding domain corp.local name-server '192.168.1.10'
set service dns forwarding domain corp.local name-server '192.168.1.11'

# Reverse zones
set service dns forwarding domain 10.168.192.in-addr.arpa name-server '192.168.1.10'
set service dns forwarding domain 20.168.192.in-addr.arpa name-server '192.168.1.10'

# External queries
set service dns forwarding name-server '8.8.8.8'
set service dns forwarding name-server '8.8.4.4'

# Cache and DNSSEC
set service dns forwarding cache-size 50000
set service dns forwarding dnssec validate

commit

Authoritative Zone for a Local Network

# DNS forwarding
set service dns forwarding listen-address '192.168.1.1'
set service dns forwarding allow-from '192.168.1.0/24'
set service dns forwarding name-server '8.8.8.8'

# Local domain
set service dns forwarding authoritative-domain home.local

# Servers
set service dns forwarding authoritative-domain home.local records a router address '192.168.1.1'
set service dns forwarding authoritative-domain home.local records a nas address '192.168.1.10'
set service dns forwarding authoritative-domain home.local records a printer address '192.168.1.20'

# Aliases
set service dns forwarding authoritative-domain home.local records cname gateway target 'router.home.local'
set service dns forwarding authoritative-domain home.local records cname storage target 'nas.home.local'

commit

Multi-Site with Several Locations

# DNS forwarding
set service dns forwarding listen-address '10.0.0.1'
set service dns forwarding allow-from '10.0.0.0/8'

# HQ site
set service dns forwarding domain hq.corp.local name-server '10.1.0.10'

# Branch office 1
set service dns forwarding domain branch1.corp.local name-server '10.10.0.10'

# Branch office 2
set service dns forwarding domain branch2.corp.local name-server '10.20.0.10'

# Shared corporate domain
set service dns forwarding domain corp.local name-server '10.1.0.10'
set service dns forwarding domain corp.local name-server '10.1.0.11'

# Internet
set service dns forwarding name-server '8.8.8.8'
set service dns forwarding name-server '1.1.1.1'

# Performance
set service dns forwarding cache-size 100000
set service dns forwarding dnssec validate

commit

DNSSEC with Validation

set service dns forwarding listen-address '192.168.1.1'
set service dns forwarding allow-from '192.168.1.0/24'

# DNS servers with DNSSEC support
set service dns forwarding name-server '1.1.1.1'
set service dns forwarding name-server '9.9.9.9'

# Enable DNSSEC validation
set service dns forwarding dnssec validate

# Increase the cache for DNSSEC
set service dns forwarding cache-size 20000

commit

Operational Commands

Clearing the Cache

Full cache flush:

reset dns forwarding all

Flush for a specific domain:

reset dns forwarding domain example.com

Restarting the Service

restart dns forwarding

Viewing Statistics

Show DNS statistics:

show dns forwarding statistics

Testing

Verifying name resolution through VyOS DNS:

nslookup example.com 192.168.1.1

or

dig @192.168.1.1 example.com

Logs

Viewing DNS logs:

show log dns forwarding
monitor log | grep recursor

Integration with DHCP

The DHCP server can automatically use DNS forwarding.

In the DHCP configuration, specify:

set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 option name-server '192.168.1.1'

Where 192.168.1.1 is the address of the VyOS host running DNS forwarding.

Troubleshooting

DNS Not Responding

Check the configuration:

show service dns forwarding

Check whether the service is running:

show dns forwarding statistics

Check the firewall:

show firewall ipv4 input filter

Make sure UDP port 53 is open:

set firewall ipv4 input filter rule 30 action accept
set firewall ipv4 input filter rule 30 destination port 53
set firewall ipv4 input filter rule 30 protocol udp
set firewall ipv4 input filter rule 30 source address 192.168.1.0/24
commit

Slow Name Resolution

Increase the cache size:

set service dns forwarding cache-size 50000
commit

Check the upstream DNS servers:

dig @8.8.8.8 example.com

Switch the upstream to faster servers:

set service dns forwarding name-server '1.1.1.1'
set service dns forwarding name-server '8.8.8.8'
commit

DNSSEC Issues

If validation causes problems, disable it:

set service dns forwarding dnssec off
commit

Or use a less strict mode:

set service dns forwarding dnssec process
commit

Split-Horizon Not Working

Make sure the domain-specific rules are specified correctly:

show service dns forwarding

Order matters - more specific domains must be specified first.

Verify by testing:

dig @192.168.1.1 server.corp.local

Security

Restricting Access

Always use allow-from to restrict the sources:

set service dns forwarding allow-from '192.168.1.0/24'

Never use 0.0.0.0/0 in allow-from - this would open DNS to the entire internet (DNS amplification attacks).

Firewall Rules

Additionally restrict access through the firewall:

set firewall ipv4 input filter rule 30 action accept
set firewall ipv4 input filter rule 30 destination port 53
set firewall ipv4 input filter rule 30 protocol udp
set firewall ipv4 input filter rule 30 source address 192.168.1.0/24
commit

Rate Limiting

Use firewall rate limiting to protect against DoS:

set firewall ipv4 input filter rule 30 action accept
set firewall ipv4 input filter rule 30 destination port 53
set firewall ipv4 input filter rule 30 protocol udp
set firewall ipv4 input filter rule 30 limit rate 50/second
commit

DNSSEC

Enable DNSSEC to protect against DNS spoofing:

set service dns forwarding dnssec validate
commit

Best Practices

  1. Use allow-from - always restrict the sources of queries
  2. Multiple upstreams - specify 2-3 upstream DNS servers
  3. DNSSEC - enable it for security
  4. Cache - tune the cache size to match the load
  5. Split-horizon - separate internal and external domains
  6. Firewall - add extra protection through the firewall
  7. Monitoring - regularly review statistics and logs
  8. Redundancy - use multiple DNS servers
  9. Documentation - document domain-specific forwarding
  10. Testing - verify name resolution after changes

Public DNS Servers

Recommended public DNS servers:

  • Cloudflare: 1.1.1.1, 1.0.0.1 (fast, private)
  • Google: 8.8.8.8, 8.8.4.4 (reliable)
  • Quad9: 9.9.9.9, 149.112.112.112 (malicious domain blocking)
  • OpenDNS: 208.67.222.222, 208.67.220.220 (content filtering)

Next Steps

Reviewed by OpenNix LLC · Last updated on
DHCP ServerSSH Server