Configure DNS

The IX14 device includes a caching DNS server which forwards queries to the DNS servers that are associated with the network interfaces, and caches the results. This server is used within the device, and cannot be disabled. Use the access control list to restrict external access to this server.

Required configuration items

Additional configuration items

To configure the DNS server:

 

  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Click Services > DNS.
  4. Click Access control list to configure access control:
    • To limit access to specified IPv4 addresses and networks:
      1. Click IPv4 Addresses.
      2. For Add Address, click .
      3. For Address, enter the IPv4 address or network that can access the device's DNS service. Allowed values are:
        • A single IP address or host name.
        • A network designation in CIDR notation, for example, 192.168.1.0/24.
        • any: No limit to IPv4 addresses that can access the DNS service.
      4. Click again to list additional IP addresses or networks.
    • To limit access to specified IPv6 addresses and networks:
      1. Click IPv6 Addresses.
      2. For Add Address, click .
      3. For Address, enter the IPv6 address or network that can access the device's DNS service. Allowed values are:
        • A single IP address or host name.
        • A network designation in CIDR notation, for example, 2001:db8::/48.
        • any: No limit to IPv6 addresses that can access the DNS service.
      4. Click again to list additional IP addresses or networks.
    • To limit access to hosts connected through a specified interface on the IX14 device:
      1. Click Interfaces.
      2. For Add Interface, click .
      3. For Interface, select the appropriate interface from the dropdown.
      4. Click again to allow access through additional interfaces.
    • To limit access based on firewall zones:
      1. Click Zones.
      2. For Add Zone, click .
      3. For Zone, select the appropriate firewall zone from the dropdown.

        See Firewall configuration for information about firewall zones.

      4. Click again to allow access through additional firewall zones.
  5. (Optional) Cache negative responses is enabled by default. Disabling this option may improve performance on networks with transient DNS results, when one or more DNS servers may have positive results. To disable, click to toggle off Cache negative responses.
  6. (Optional) Query all servers is enabled by default. This option is useful when only some DNS servers will be able to resolve hostnames. To disable, click to toggle off Query all servers.
  7. (Optional) Rebind protection, if enabled, prevents upstream DNS servers from returning private IP addresses. To enable, click Rebind protection.
  8. (Optional) Allow localhost rebinding is enabled by default if Rebind protection is enabled. This is useful for Real-time Black List (RBL) servers.
    1. Click DNS servers.
    2. For Add Server, click .
    3. (Optional) Enter a label for the DNS server.
    4. For DNS server, enter the IP address of the DNS server.
    5. Domain restricts the device's use of this DNS server based on the domain. If no domain are listed, then all queries may be sent to this server.
    1. Click Additional DNS hostnames.
    2. For Add Host, click .
    3. Type the IP address of the host.
    4. For Name, type the hostname.
  11. Click Apply to save the configuration and apply the change.
  1. Select the device in Remote Manager and click Actions > Open Console, or log into the IX14 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:
    > config
(config)>
  3. Configure access control:
    • To limit access to specified IPv4 addresses and networks:
      (config)> add service dns acl address end value
(config)>

      Where value can be:

      • A single IP address or host name.
      • A network designation in CIDR notation, for example, 192.168.1.0/24.
      • any: No limit to IPv4 addresses that can access the DNS service.

      Repeat this step to list additional IP addresses or networks.

    • To limit access to specified IPv6 addresses and networks:
      (config)> add service dns acl address6 end value
(config)>

      Where value can be:

      • A single IP address or host name.
      • A network designation in CIDR notation, for example, 2001:db8::/48.
      • any: No limit to IPv6 addresses that can access the DNS service.

      Repeat this step to list additional IP addresses or networks.

    • To limit access to hosts connected through a specified interface on the IX14 device:
      (config)> add service dns acl interface end value
(config)>

      Where value is an interface defined on your device.

      Use ... network interface ? to display interface information:

      (config)> ... network interface ?

Interfaces

 Additional Configuration
 -------------------------------------------
 defaultip              Default IP
 defaultlinklocal       Default Link-local IP
 lan                    LAN
 loopback               Loopback
 modem                  Modem

config)>

      Repeat this step to list additional interfaces.

    • To limit access based on firewall zones:
      (config)> add service dns acl zone end value

      Where value is a firewall zone defined on your device, or the any keyword.

      Type ... firewall zone ? at the config prompt:

      (config)> ... firewall zone ?

Zones: A list of groups of network interfaces that can be referred to by packet
filtering rules and access control lists.

 Additional Configuration
 -------------------------------------------------------------------------------
  any
  dynamic_routes
  edge
  external
  internal
  ipsec
  loopback
  setup

(config)>

      Repeat this step to list additional firewall zones.

  4. By default, the device's DNS server caches negative responses. Disabling this option may improve performance on networks with transient DNS results, when one or more DNS servers may have positive results. To disable:

    (config)> service dns cache_negative_responses false
(config>

  5. By default, the device's DNS server queries all available DNS servers. Disabling this option may improve performance on networks with transient DNS results, when one or more DNS servers may have positive results. To disable:

    (config)> service dns query_all_servers false
(config>

  6. By default, rebind protection is disabled. If enabled, this prevents upstream DNS servers from returning private IP addresses. To enable:

    (config)> service dns stop_dns_rebind false
(config)>

  7. By default, localhost rebinding is enabled by default if rebind protection is enabled. This is useful for Real-time Black List (RBL) servers. To disable:

    (config)> service dns rebind_localhost_ok false
(config)>

    1. Add a DNS server:
      (config)> add service dns server end
(config service dns server 0)>
    2. Set the IP address of the DNS server:
      (config service dns server 0)> address ip-addr
(config service dns server 0)>
    3. To restrict the device's use of this DNS server based on the domain, use the domain command. If no domain are listed, then all queries may be sent to this server.
      (config service dns server 0)> domain domain
(config service dns server 0)>
    4. (Optional) Set a label for this DNS server:
      (config service dns server 0)> label label
(config service dns server 0)>
    1. Add a host:
      (config)> add service dns host end
(config service dns host 0)>
    2. Set the IP address of the host:
      (config service dns host 0)> address ip-addr
(config service dns host 0)>
    3. Set the host name:
      (config service dns host 0)> name host-name
(config service dns host 0)>
  10. Save the configuration and apply the change:
    (config)> save
Configuration saved.
>
  11. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.