Can a Local DNS Server be used across several [LAN] Networks?

[TheGoob]

Hello

I run PiHole as a LOCAL DNS Server as well as DNS [WAN] in General. Currently my DHCP Server is handing out IP's and is also using 192.168.5.115 as DNS, as it is PiHole. With dividing up my network into vlans thus creating other Networks, can I still use 192.168.5.115 on, let's say, 192.168.2.0/192.168.3.0 etc? Port 53 will obviously be open to these Subnets. I was just curious if it would work.

[Joseph W. Doherty]

If you're routing correctly, yes it should work.

[TheGoob]

Well, I would have 192.168.1.0 - 192.168.6.0 all their own vlan [1-6] and all their own WAN Static IP's. My assumption is to allow all [LAN] zones (I made a separate zone for each vlan) access to the zone that hosts the DNS Server; So, all vlans have access Port 53 on the Hosting vlan for DNS.

So, under DNS, I would have 192.168.1.115 as DNS 1, and all inside / vlan interfaces would look to it. I would naturally have others as well, in case my .115 went down.

[MHM Cisco World]

if you use DHCP then you can push the DNS server IP to all host. 
this make FPR only forwarding the traffic not proxy it.
why I need DNS in FW or IOS router?
there is some domain is local and we dont have internal DNS, so we make FW or IOS router DNS to resolve DNS query and other query the FW/R will resend it to public DNS server. 
does DNS proxy have any effect in FW performance ?
Yes, it can put more work in CPU and it occupied memory. 

so here since you have internal DNS then use it and only open ports (as you already do)
MHM 

[paul driver]

Hello
yes you can - if the dhcp server isn’t local though then you will need to append a helper address on each L3 subnet of the rtr/l3 switch so to relay Dhcp messages towards the server 

[TheGoob]

What are you meaning when it isnt local?

vlan 1, 192.168.1.0

vlan 2, 192.168.2.0

vlan 3, 192.168.3.0

vlan 4, 192.168.4.0

vlan 5, 192.168.5.0

vlan 6, 192.168.6.0

My PiHole DNS Server is running on 192.168.4.115.

Every IP on any vlan can PING it, but when I use it as it's/their DNS Server, name resolution does not work, as if it is not passing through it.

[TheGoob]

Morning..

So I am hearing that I can do it as I suggested? The DHCP Servers [I have 1 per vlan naturally] all use the DNS direction ON the FPR and so on the FPR, I select which Interfaces [I would select all vlans interfaces] to use 192.168.1.115 as their DNS, and make 8.8.8.8 or whatever as Secondary, and then every vlan that gets it's LAN IP will use the default FPR DNS IP [192.168.1.115] as it's DNS.

I would also give an ACL to each vlan to have Port 53 [DNS] access TO 192.168.1.115, so that it could indeed get that IP.

This in itself would work out as I am hoping.

[TheGoob]

Alright, so it is not working.

FIRST OF ALL, When assigning my VLAN/INSIDE Network it's own DNS, is this under DNS SERVERS, or DHCP SERVER/CONFIGURATION.

Cause, there are 2 options.

[ammahend]

it would be under your dhcp configuration, as part of dhcp process endpoints will get IP, mask, gateway, dns and other options if set. 

don't apply any acl initially, make sure clients get an IP first then apply acl, feel free to share your config.

keep in mind order of operation of a router, because depending on how and where you apply ACL your source and destination will change.

Rules:

– Traffic entering inside NAT interface is always routed 1st then NATted.

– Traffic entering outside NAT interface is always NATted 1st then routed.

– Inbound ACL are performed before routing & NAT, alleviate processing overhead by filtering unnecessary traffic.

– Outbound ACL is performed after routing & NAT.

[TheGoob]

It does make sense, that there is an order to the rules but I am just having a gnarly time wrapping my head around it. I will have to get you my running_config as soon as I can.

Currently ALL Networks/vlans (hosts) get their appreciate IP’s and can get in the WEB, so that is a plus. 
Currently I have ONLY. 5 NAT Rules; Static WAN IP to vlan NETWORK I.E x.x.x.178 NAT to 192.168.1.0. 
For all I know I may need NAT rules for incoming?

As far as ACL’s, the default “in to out” and then I have messed with some but it seems they do not work. Again I’ll have to explain more in detail my ambitions as well as show you my running_config.  

[MHM Cisco World]

Under Dhcp server

MHM

[TheGoob]

So, based on my understanding...

x.x.x.177 NAT 192.168.1.0 (vlan2)

x.x.x.178 NAT 192.168.2.0 (vlan3)

x.x.x.179 NAT 192.168.3.0 (vlan4)

x.x.x.180 NAT 192.168.4.0 (vlan5)

x.x.x.181 NAT 192.168.5.0 (vlan6)

x.x.x.182 NAT 192.168.6.0 (vlan1/default FPR LAN)

----------------------------------------------These are my ONLY NAT entries

As far as DHCP Servers, I have a separate DHCP Server for each vlan; This seems to be working as any device I connect to any vlan Interface, grabs it's correct LAN IP..

------------------------------

So, thus far NO other NAT entries... I assume I would need a NAT entry for every INCOMING service [port forwarding], So obviously the packet would know "where" to go. If so, would these specific NAT entries be BEFORE my Static 1-to-1 Entries?

-----------------------------

As far as ACL's.. I ONLY have the default in-to-out. I then made a 2nd one inside-to-all-other-vlans ACL.. Below them I was doing the OUTSIDE to IN for my email/web proxy etc.. I assume they are placed wrong? They should be on top? Sorry, I am sorta asking +preparing.. I will still show you photos later of my GUI plus my running-config.

[ammahend]

if possible share your running config and topology.

[MHM Cisco World]

So, thus far NO other NAT entries... I assume I would need a NAT entry for every INCOMING service [port forwarding], So obviously the packet would know "where" to go. If so, would these specific NAT entries be BEFORE my Static 1-to-1 Entries?
friend you can not use Subnet to One IP NAT using static 1-to-1 
you need dynamic NAT (PAT)

As far as ACL's.. I ONLY have the default in-to-out. I then made a 2nd one inside-to-all-other-vlans ACL.. Below them I was doing the OUTSIDE to IN for my email/web proxy etc.. I assume they are placed wrong? They should be on top? Sorry, I am sorta asking +preparing.. I will still show you photos later of my GUI plus my running-config. for this it better to share the ACL you use 

MHM

[TheGoob]

Alright, first, you are right, I have NO NAT aside from the static 1 to 1... I do know that the packet needs to know where to go, I simply was not sure the location. As far as STATIC or DYNAMIC, Again, I was unsure.. I guess it does make sense STATIC would be 1 WAN IP to 1 LAN ip, whereas DYNAMIC would be "any ip in subnet to 1 wan ip", so I will change the STATIC NATS to Dynamic.. I will then create the incoming Service nat and put ahead of it's relative 1 to 1 [pat] NAT.

As far as my ACL's, I did post my running-config as well as a pic of the GUI. NOW, I can explain my intent in the pictures, but again I am just so confused about placement.