Re:The Sisyphean Task of DNS Client Config on Linux
by throwaway823882 on Thursday April 15, 2021 @08:20PM
(#26827832)
You can technically add an iptables match rule to only forward DNS packets whose contents match a ".internal" DNS query, but it sounds like a recipe for disaster. It would be better if they wrote an actual iptables protocol filter for DNS (assuming one doesn't exist) but that's so much work for so little benefit.
[ Parent
| on HN ]
Re:The Sisyphean Task of DNS Client Config on Linux
by ptomato on Thursday April 15, 2021 @08:44PM
(#26827997)
sure, but that's why BPF is so great; I'd guess a reasonable program that assumes port 53, parses the packet enough to look at the first question and compare domain against .internal and then rewrites address + updates checksum is maybe... 300-400 LOC? can probably get a bit fancier, but it shouldn't be too painful to write and will execute plenty fast enough.