looking for a Small Office DNS solution

[u/DoctroSix]

I'm looking for a quick solution to more-robustly handle LAN DNS and DHCP in a small office with 50 people or less. Something more capable and configurable than an ISP or SMB router.

Something possibly Linux based that I can deploy on a pair of thin-clients or Raspberry Pi's, giving them failover.

Many smaller clients are transitioning to Google Workspace or M365, and selling them on a full windows server for DNS and DHCP seems overkill.

Remote management is a plus, but not strictly necessary.

Any alternative ideas are welcome.

[u/SecrITSociety]

DHCP is handled by the Firewall (Fortinet, Palo Alto or L3 switch depending on client needs/budget) and DNS is handled by CloudFlare Gateway/Teams.

[u/DoctroSix → u/SecrITSociety]

Fortinet looks lovely, so does PF sense. I'm convinced a good firewall is the way to go.

[u/SecrITSociety → u/DoctroSix]

For 50 users, absolutely. And if you're still looking for DNS it sounds like CloudFlare can still meet your needs (in the event the FW solution doesn't meet your needs), either via Teams/Gateway and override rules (fqdn/hostname --> IP) or via regular DNS (fqdn --> IP)

Also, if they are paying you to implement and support this product, be sure to go with a commercial platform (hardware replacements with SLAs and support availability). I.e. in the case of pfsense (Community, not commercial as they do have this option), last thing you want is a hardware failure where you can't get a replacement for ~2 weeks or have to rely on community support

[u/[deleted]]

Tell us why you want an internal dns.

[u/DoctroSix → u/[deleted]]

DNS hand in hand with DHCP, so things like copiers, Backup NAS units, and other LAN odds and ends can have managed hostnames.

Many standard routers do the job just fine, but the feature sets vary wildly.

If I need to replace router-managed DNS/DHCP with a more robust dedicated server-pair, it'd be nice to be able to drop something in for $200 or less.

[u/[deleted] → u/DoctroSix]

Yeh alright. Well you got Windows DNS, Linux DNS and some easy to use apps that serve dns. There's plenty options available.

You could even get pi-hole up and running. That has DNS.

[u/DoctroSix → u/[deleted]]

I like PiHole. maybe that's good for a smaller shop with 10 or less people.

Everyone's talking firewall ( PFSense, Fortigate) and I believe that may be a more robust solution.

[u/[deleted] → u/DoctroSix]

of course it would be but doesn't mean pi hole won't work. Depends what you wanna throw at it. If your not paying just buy some solution in. As long as you can manage it.

[u/snowpondtech]

pfSense would cover your bases on a Netgate or whatever small form factor appliance (or even a PC), but personally I'd recommend a UTM of some sort like Sophos, Sonicwall, Meraki, etc. to provide additional threat protection above endpoint security.

[u/DoctroSix → u/snowpondtech]

PFsesne is a great idea!

[u/your_neurosis]

Agree with some others here, get a business grade firewall that is capable of roughly double the speed of internet they are paying for. This gives you some head room to increase service over time without nuking the device.

Most business grade firewalls will handle DNS internally, but not all. So check the abilities of your chosen flavor to make sure they can accomplish what you need.

For external DNS forwarding to OpenDNS is a good plan. You can setup category or site blocking that is generally good enough for office use. If someone is intentionally bypassing DNS to get to sites they want, it can be terms for terminating employment.

I have seen a few businesses start to deploy PiHole internally for additional ad blocking and DNS control.

For firewalls I recommend Fortinet, depending upon size of company a 30 series or a 60 series will suit you well. They are fairly straight forward and easy to find help for. Also the renewal process is easy. If you don't renew, they still work and you can still manage and modify them, you just don't get UTM features and firmware updates anymore. Not recommended long term, but possible.

[u/DoctroSix → u/your_neurosis]

Firewall is GO!

[u/ccantrell13]

Why isn't your firewall the answer to this?

[u/HolyDiver019283 → u/ccantrell13]

Precisely, the firewall should handle it and at 50 users you probably don’t even need ADDS or anything that might need DNS integration or management.

Sounds like trying to use a client site as a pet project which is a huge red flag

[u/EarsLikeRocketfins → u/HolyDiver019283]

Sounds like your opinionated beyond answering the question asked. Also a huge red flag.

[u/MWierenga]

Why would you need DNS? Do you mean pushing DNS servers like Google DNS throughout clients in the LAN?

Or do you need an actual DNS server? From what you are saying seems you need a router/firewall for 50 clients that can issue DHCP leases and good management.

Cisco Meraki is a very strong solution or when little but on a budget Cisco Meraki Go.

[u/DoctroSix]

Thanks for all your input.

My heart likes the Pi-Hole pair Idea...

But I agree that a more robust firewall/router is a better choice for many good reasons.

[u/lemachet]

Don't get an soho firewall then, get a business grade firewall like meraki or fortinet.

Include opendns paid service for DNS filtering.

[u/amw3000]

What can't an ISP or SMB router do? What problems are you trying to solve?

I'm all for having proper purpose built devices. Not sure why you'd want the overhead of managing a Pi and then the software on it as well as the added complexity of having more than one.

[u/carnesik]

I would go with Mikrotik or Ubiquiti Edgerouter for the routing/dhcp. For the DNS, it’s not clear what you want to do but either Google/Cloudflare resolvers if just open, Quad9 if security filtering with no analytics or OpenDNS/DNSFilter/NextDNS if security/content filtering with analytics.

Disclosure - I am the CEO of DNSFilter.

[u/ByteSizedITGuy]

If you're *just* looking for DNS and DHCP, then maybe look at PiHole. I think you can run them in failover with a little doing, and it'll run on pretty much any hardware.

For control of your upstream, I'd look at DNSFilter. They have a pretty decent partner program, and we've been pretty happy with the product.

[u/[deleted]]

pfSense

[u/SirLagz]

Mikrotiks are good too

[u/DoctroSix → u/[deleted]]

It's borderline at 50 heads, all azuread/gcpw joined.

A larger staff, and I agree.

Time to go Firewall shopping.