DNS allows you to use easy-to-remember domain names for your favorite websites, rather than having to remember their IP addresses—a difficult task for many people!
DNS forwarding is a fundamental part of the Domain Name Service (DNS), and it’s how internet domain names like “http://www.google.com/” get translated into numerical IP addresses like “74.125.236.1 .”
For example, imagine using an Ethernet cable to connect your computer directly to another computer on the same network. You would not need DNS because each computer could send packets directly without first passing them through a central router or switching on the network to interpret these messages and route them correctly.
Features Of DNS Forwarding
DNS forwarding is a feature provided by a few different network routers and, in some cases, can also be achieved on a computer’s operating system level. For example, Windows Vista SP1 and later have built-in support for DNS forwarding.
Your router’s web interface should allow you to add DNS servers that the router will consult when processing requests from any device connected to it. In many cases, this functionality might even exist outside the context of DNS but instead, be known as “network settings.”
To configure your router correctly so that your ISP’s recursive DNS servers are used only if no other options can be found (i.e., they fall back), you should consult the documentation for your router model and/or refer to third-party resources online. Alternatively, you may choose only to allow the use of your ISP’s DNS servers when a device cannot reach any other DNS server.
(e.g., in this example, if a particular guest computer cannot connect with Google’s 8.8.8.8 or 8.8.4.4 DNS servers).
Purpose Of DNS Forwarding
Since your computer’s network connection exists on a local (i.e., non-routable) IP address, your computer could only send packets directly to another computer that sits on the same network as you do. In most cases, this would either be impossible or highly impractical as most networks have many computers, and there is no way of knowing which computers share an IP address with you.
Using DNS forwarding allows you to take advantage of the fact that virtually all modern networks sit behind routers and switches or internet connection sharing devices that can use potentially thousands of routable IP addresses for their clients simultaneously.
Benefits Of DNS Forwarding
- You will have more practical options for reaching the host you’re attempting to communicate with.
- For websites that you occasionally use, it is easier and faster to remember a domain name than an IP address for each website.
- This allows devices on your network or computers that you connect with via VPN or SSH from off-network locations (including perhaps even mobile devices) to easily reach servers on your local networks such as your web server, email server, or other services like media streaming.
- Even though most ISPs assign customers dynamic IP addresses (i.e., they change every so often), when properly configured, DNS forwarding can allow clients in these situations always to find their favorite websites by name, even if their IP address changes.
- This allows devices on your network or computers that you connect with via VPN or SSH from off-network locations (including perhaps even mobile devices) to easily reach servers on your local networks such as your web server, email server, or other services like media streaming.
Drawbacks Of DNS Forwarding
- It’s important to realize that DNS forwarding does not protect against external threats like viruses and malware, even though it can be beneficial.
- Additionally, attackers could potentially use this mechanism to reach computers on your network by simply asking your ISP’s recursive DNS servers for the names of every device behind your router or switch until they find one that responds with a valid address.
- Other than port-forwarding as part of a VPN setup as described below, there is no practical way to protect yourself from such an attack without using cryptographic protocols such as DNSSEC.
As a result, you should always make sure to filter out the IP addresses of devices on your local network from any third-party recursive DNS servers. Noisy services like BitTorrent also pose a security threat because an attacker can easily use them as part of an attack designed to cause large numbers of inconclusive DNS lookups for various subdomains of frequently visited websites, thus potentially slowing down or even crashing unsecured recursive DNS servers with bogus traffic.
Conclusion
This attacker can easily use the article to explain what DNS forwarding is and how it can be used. We also listed its advantages and disadvantages compared to using a third-party recursive DNS server.
The host you’re attempting to communicate with. For websites that you occasionally use, it is easier and faster to remember a domain name than an IP address for each website.
It’s important to realize that DNS forwarding does not protect against external threats like viruses and malware, even though it can be beneficial. Additionally, attackers could potentially use this mechanism to reach computers on your network by simply asking your ISP’s recursive DNS servers for the names of every device behind your router or switch until they find one that responds with a valid address. Other than port-forwarding as part of a VPN setup as described below, there is no practical way to protect yourself from such an attack without using cryptographic protocols such as DNSSEC.
