Can I route internal DNS requests to another server?`

Question

I have a bunch of internal computers, accessing a specific DNS server (internal Server). I'd like to setup some redundancy, in the event that DNS Server goes down, and quickly set routes, at the router level to forward any traffic destined for the DNS Server (10.0.1.2) to (8.8.8.8) at the router level. Is that possible? I'm using Watchguard, but i'm not necessarily looking for a router specific answer.

For example -

Client sends a DNS request to 10.0.1.2 The router, see's this, and re-routes to 8.8.8.8 instead of 10.0.1.2

Answer 1

You hand out a backup DNS server address to your endpoints via DHCP. That's how it's done. A router should not be involved.

Answer 2

If you want to translate a network address, that is called NAT. Most people use source translation with NAT, but you could also use destination translation. This can be done with some vendors.

A problem with what you describe would be if the host making a DNS request is on the same network as the DNS server, then the traffic will never go through a router, so it will never be translated.

Also, when using NAT, you will either always be translating, or you will need to manually configure it when there is a problem with a primary DNS server. A better method is to assign multiple DNS servers in the hosts, and most host OSes allow this. It can be done manually on each host, or through DHCP if that is how the hosts are addressed.

Answer 3

To perform a translation like this a few things need to hold

1. The router needs to have a suitably flexible NAT implementation.
2. The traffic needs to actually reach the router
3. The return traffic needs to return via the same router so it can be correctly reverse translated.

Point 1 is certainly true for Linux NAT, I can't comment on other implementations.

Point 2 is fine if the DNS server is on a different subnet from the client but if they are on the same subnet then some trickery is needed. It would be possible to have a script make the router take over the DNS server's IP address but then you have a potential IP conflict to deal with when the DNS server comes back up.

Point 3 means you need to think about your routing. If there is only one path from the client machine to the internet and the same path back then you are fine. Otherwise you may have problems.

Overall, while certainly possible to implement this seems like a bad idea. Far more sensible to just have two DNS servers and then set the "primary" and "secondary" DNS server settings appropriately.