On-the-fly Dynamic DNS Doctoring (Rewrite) for a 1-to-1 NAT using PowerDNS Recursor

The Problem

Corporate mergers and IP address scheme reallocation can be a major pain point, especially when you have legacy systems that cannot have their network settings modified. One solution is to preserve the legacy network and use a 1:1 NAT to remap the entire network to a new IP space. While this solution resolves IP conflicts, it causes problems when you still need to route traffic to that subnet from systems outside of that network. The responses from the DNS servers on the re-mapped network are responding with the original set of IP addresses and so your traffic will end up going to the wrong destination. 

Bad Solutions

The most common solution is to maintain a hosts file or setup a stub zone that you manually maintain. The downside of this is that it is a lot of work. The other downside of this is that you now have multiple locations in which to maintain DNS updates and it will break anything that relies on dynamic DNS updates. The end result of this is all the headaches of split-horizon DNS as well as the inability to manage dynamic DNS records.

A Less Bad Solution

So how do we overcome dynamic DNS updates? My solution is to translate DNS replies as they come across the wire. This is not packet interception, rather using a intermediate DNS server as a conditional forwarder for the target domain. This will not work on DNSSec and I have only implemented A-Record modifications.

As an overview of the lookup process, see the below graphic:

An overview of the lookup process

I turned to PowerDNS Recursor because of its Lua script hooks. This allow PowerDNS to intelligently match and modify DNS A records from predefined ranges. In the example above, The Fabrikam.com DNS server has a conditional forward for mte.contoso.com to the PowerDNS server. That server will in-turn conditionally forward mte.contoso.com lookups to the mte.contoso.com DNS servers. If the reply for a result matches criteria specified in the Lua script, PowerDNS will rewrite the response that it then delivers to the Fabrikam.com DNS server.

PowerDNS Logs as record translations occur

This embedded Lua script will perform the modifications as discussed. Simply drop it into your working PowerDNS Recursor, modify the constraints for your environment, and go.