DNS

nEdge can enforce specific DNS servers to be used by LAN devices and provides some presets with secure DNS servers, which provide an additional security against malware sites.

Global DNS

The DNS servers configured in the Global DNS section of the DNS Configuration tab are used in the following cases:

• When the DHCP server is enabled (routing mode), clients (which are non child-safe) are configured to use those DNS servers
• By the nEdge device for interfaces configured in static address mode

If the Enforce Global DNS option is enabled, nEdge will enforce the use of the specified DNS servers even if the clients configure their DNS servers manually.

The presets provide a list of Secure DNS servers that can be chosen, otherwise it is possible to specify 'Custom' DNS servers manually.

.. figure:: img/global_dns.png :align: center :alt: Global DNS

Global DNS configuration

Child Safe

The Child Safe DNS is the DNS used for users which are marked with the Child Safe option.

.. figure:: img/child_dns.png :align: center :alt: Child DNS

Child DNS configuration

Such DNS can protect the children from inappropriate adult content.

Note: nEdge will always enforce the use of such a DNS for all the child safe users, even if they manually change their DNS servers.

DNS issue: 5 seconds delay

Due to a bug_ into the kernel, there is an issue with the DNS resolver of some versions of glibc, which causes a client program to stuck for about 5 seconds when performing A and AAAA DNS requests using the same socket. This can be verified with the following command:

conntrack -S

When the issue occurs, the command above will increase the insert_failed counter. A temporary solution to the issue is to force glibc to use a different socket for the AAAA request. On a Linux client, this can be done by adding the following line to /etc/resolv.conf:

options single-request-reopen

.. _bug: https://www.weave.works/blog/racy-conntrack-and-dns-lookup-timeouts