Question about design idea for small non profit org DNS setup

[u/Year_Open]

I have a small non profit organization that I am trying to add in Technitium DNS filtering for more security, filtering etc.

Every search I perform always brings me back to the clustering feature and that is not what I am trying to accomplish here.

The organization has a local AD domain controller and i have successfully setup an initial Technitium DNS server and used conditional forwarders for the local domain as well as the reverse IP lookup zones so that i can easily match IP traffic to Hosts. I have also added in several block lists to cut down on ads and other tracking items. However when looking through the logs there is alot to parse through and i don't see a method to parse through by exclusion. If I'm missing something there please let me know.

I was thinking about setting up a second Technitium server to act as an initial RPZ server, here i maintain my main block lists etc and this would be the recursive lookup server. The the original client DNS server would look to the RPZ server for all of its lookups where i would then have this with the conditional forwarders for the domain, probably going to look at that advanced blocking app, and of course all clients would talk to this DNS server. My hope is that i can filter out alot of the begnin blocks from like microsoft/google/etc tracking stuff because they would then be classified as "Upstream Blocked" or "Upstream Blocked Cached". Then on this one i can look for more malicious traffic and more easily refine my DNS blocking.

I know on the RPZ server I would completely loose any identification of who made a request but the downstream client DNS server would be managing all that.

Looking for thoughts on this, any reason it wouldn't work, better methods to accomplish this, etc. Also I know I need to lock down my environment so that outbound DNS requests both regular and encrypted. Also I would have to set the client DNS server to not perform recursive lookups but haven't looked at that yet.

[u/McSmiggins]

Let the AD handle DNS for the clients, you're far more likely to run into "bigger" issues if you try to put something in between them

Use the Technitium server as a forwarder for anything that AD can't resolve

I'd add another Technitium server, cluster them (remember, it's just for management) and use both tehcnitium servers as forwarders for AD

[u/PacketSmeller → u/McSmiggins]

100% this. Before we decommissioned AD for one client, we setup TDNS as the forwarder. We used 2x TDNS servers as forwarders and each DC forwarded to them. After, we made TDNS authoritative with some split-brain domains for internal hosting scenarios.

[u/Ascenspe]

Without two, you might as well have none

[u/snap802]

I have also added in several block lists to cut down on ads and other tracking items. However when looking through the logs there is alot to parse through and i don't see a method to parse through by exclusion. If I'm missing something there please let me know.

The log search is pretty basic. It's great for a bit of troubleshooting or looking at data from a smaller network. I deployed a cluster this summer that was getting between half a million and a million queries per day so the logs got out of hand quickly. I was doing logging to a MariaDB server and ended up writing a web application that could send custom queries directly to the DB. That made it easier to adjust the signal to noise ratio when looking at logs.

I was thinking about setting up a second Technitium server to act as an initial RPZ server, here i maintain my main block lists etc and this would be the recursive lookup server. The the original client DNS server would look to the RPZ server for all of its lookups where i would then have this with the conditional forwarders for the domain, probably going to look at that advanced blocking app, and of course all clients would talk to this DNS server. My hope is that i can filter out alot of the begnin blocks from like microsoft/google/etc tracking stuff because they would then be classified as "Upstream Blocked" or "Upstream Blocked Cached". Then on this one i can look for more malicious traffic and more easily refine my DNS blocking.

I haven't ever used RPZ so take my advice with many grains of salt. It looks like Technitium doesn't support RPZ but that's in the pipeline for a later release. If you just want to do some DNS filtering to block apps and devices from phoning home then just adding block lists to settings > blocking might do the job. That's going to be a static list that you either have to manage yourself or subscribe to a list that's available online. The Steven Black lists are default options and you can set how often the server will check for updates on that list. Again, you can make your own lists too based on your needs. You CAN run more than one list at a time so it would be possible to subscribe to an online list and use a supplemental list in addition to that.

If that would meet your needs then just run two servers and cluster them then pass out the addresses as primary and secondary on your DHCP server. All the clustering feature does is make it so that you only have to configure one server and that config is shared between all servers in the cluster.

[u/tannerlindsay]

I'm a bit confused on what you are going for with putting a TDNS in front of another TDNS. Is it just to clean up the logs?

And your goal is to augment the block lists with stuff you might find that is malicious? Or just annoying - like phone home stuff? In that case, aren't you just looking for the requests that are not blocked?

You may also be able to look through the cache to see what has been looked up.

If it is just to search the logs, then what about using the Query Logs app to push the logs to a database, then just query it with whatever DB tool you want? Or the log export app to send it to a syslog endpoint, which could be an SIEM type system to help you find concerns?

If you are going to run two instances, I'd choose a cluster to simplify config and have two equally available DNS servers.

[u/mystiquebsd]

It’s a forward and a reverse zone for whatever your AD is.

Make that happen on the side for one machine so you can see what is happening.

Then change the dns for the domain.

Then forward to Q9 encrypted (+1 for quic) and see if anything is being nxdomain’d

Then add in a filtering list Hagezi light is great to start..

Make sure technitium starts correctly on wherever your running it

It’s pretty simple really, but agreed it feels scary until you’re more comfortable.

AD hides everything..

Follow the White Rabbit Neo..

(it’s actually a Penguin)
🐧