Product Documentation

DNS Support for the Responder Feature

Jun 17, 2015

You can configure the responder feature to respond to DNS requests as it does to HTTP and TCP requests. For example, you could configure it to send DNS responses over UDP and ensure that the DNS requests from the client are sent over TCP. A number of NetScaler expressions support examination of the DNS header in the request. These expressions examine specific header fields and send an appropriate response.

DNS Expressions

In a responder configuration, you can use the following NetScaler expressions to refer to various portions of a DNS request:

Expressions Descriptions
DNS.NEW_RESPONSE Creates a new empty DNS response based on the request.
DNS.NEW_RESPONSE <AA, TC, rcode> Creates a new DNS response based on the specified parameters.

DNS Bind Points

The following global bind points are available for policies that contain DNS expressions.

Bind Points Descriptions
DNS_REQ_OVERRIDE Priority/override request policy queue.
DNS_REQ_DEFAULT Standard request policy queue.

In addition to the default bind points, you can create policy labels of type DNS and bind DNS policies to them.

Configuring Responder Policies for DNS

The following procedure uses the NetScaler command line to configure a responder action and policy and bind the policy to a responder-specific global bind point.

To configure Responder to respond to a DNS request

At the command prompt, type the following commands:
  1. add responder action <actName> <actType>

    For <actname>, substitute a name for your new action. The name can be 1 to 127 characters in length, and can contain letters, numbers, hyphen (-), and underscore (_) symbols. For <actType>, substitute a responder action type, respondWith.

  2. add responder policy <polName> <rule> <actName>

    For <polname>, substitute a name for your new policy. For <actname>, the name can be 1 to 127 characters in length, and can contain letters, numbers, hyphen (-), and underscore (_) symbols. For <actname>, substitute the name of the action that you just created.

  3. bind responder policy <polName> <priority> <nextExpr> -type <bindPoint>

    For <bindPoint>, specify one of the responder-specific global bind points. For <polName>, substitute the name of the policy that you just created. For <priority>, specify the priority of the policy.

Example

Enforce all DNS request over TCP

To enforce all the DNS requests over TCP, create a responder action that will set the TC bit and rcode as NOERROR.

add responder action resp_act_set_tc_bit respondwith DNS.NEW_RESPONSE(true, true, NOERROR) 
add responder policy enforce_tcp  dns.REQ.TRANSPORT.EQ(udp)  resp_act_set_tc_bit 
bind lb vserver dns_udp –policyName  enforce_tcp   -type request –priority 100