OpenDNS - very kewl

I recently read an article on the New York Times about OpenDNS which describes its service as:

OpenDNS is a safer, faster, smarter and more reliable way to navigate the Internet.

Well, after reading the article on the New York Times I was intrigued to say the least so I started snopping around the OpenDNS web page and got MORE intrigued. One reason I got more and more interested is the services they offer for blocking less-then-savory web sites. What I liked about these value-add services is the price is right ... its free. Its interesting in that they have it setup where you can block various sites based on categories of adult themes: bikini vs nudity vs pornographic etc while using nothing more then DNS. So nothing to download and install on your home machines. I have enough of a selection of machines at home (FreeBSD, Solaris, Mac OS X, and Windows XP) that anything requiring installing a client on each machine type would instantly kill my interest in the service.

( While being very interested in this DNS service technically, in the end, my true motivation is that I have kids getting onto the Internet more these days and I'm looking to avoid for as long as I can the inevitable "Daddy, what are they doing ?!?!?!?!?" .... notice I said "inevitable" )

So I took the plunge and I signed up for an account. You have to signup for an account to activate the adult theme blocking service. Again ... signup is free in case you missed that part above.

One challange I had is I have a DNS server setup here at home for my internal network of machines - Its a Solaris Neveda machine no less (snv_67 currently). So how to setup my DNS server so its still authoritative for my internal domain and then push queries out to OpenDNS for DNS query resolution.  The answer = Sun's employee subscription to Safari Books Online -> DNS and BIND, 5th Edition -> Section 10.5 Forwarding.  Man, do I love that Safari subscription ...

I tweaked my /etc/named.conf file to look like the following:

options {
        directory "/var/named";
        forwarders { 208.67.222.222; 208.67.220.220; };
        forward only;
};

zone "."                        { type hint;    file "db.cache"; };
zone "0.0.127.in-addr.arpa"     { type master;  file "db.127.0.0"; forwarders {}; };
zone "nonroutable.com"          { type master;  file "db.nonroutable"; forwarders {}; };
zone "0.168.192.in-addr.arpa"   { type master;  file "db.192.168.0"; forwarders {}; };

So the interesting parts are the "forwarders", "forward only", and "forwarders {}" directives. The "forwarders" directives tells bind to forward all queries bound for external resolution to the specified DNS servers (these being the OpenDNS DNS servers). The "forward only" directive means to rely on the forwarded DNS server for everything e.g. never ask any other DNS servers for query resolution. The reason for this is I don't want my DNS cache on my name server polluted with anything that's not from OpenDNS. For each of my master authoritative zones, the empty "forwarders {}" basically disables DNS forwarding for these zones and allows my DNS server to act as an authoritative DNS server like it should for each specific master zone files.

Next issue is how do I get my DHCP clients to get the benefits of OpenDNS now that I've setup my OpenDNS account and tweaked my DNS server ? Simpe update to my DHCP configuration on my LinkSys WRT54G to put my DNS server first in the DNS server list followed by the same two OpenDNS IPs seen in my /etc/named.conf file above.

OpenDNS also supports DDNS for ISPs like mine that provide DHCP to your internet router.  Unfortunately, my WRT54G only supports DDNS to DynDNS.org and TZO.com.  I can't tweak it to support another DDNS service.  This is important because to get the benefits of the adult site filtering from OpenDNS, they have to know the source IP address of where you DNS queries are coming from.  If/When the IP provided by your ISP changes and without DDNS letting OpenDNS know your IP address has changed, then you lose your adult filtering services from OpenDNS until you log into your OpenDNS account and tweak your account configuration.  Not sure how to resolve this just yet.

Posted at 10:20PM Jul 12, 2007 by ldcubed in Other-Than-Solaris  |  Comments[5]