Setting up Bind with Redsocks?

Question

linux

Good night everybody. There was a problem in setting up the Redsocks program, or rather its 'dnstc' module, which allows you to make a kind of 'hack', by changing the DNS server ip. Here is the off-site of this miracle. There are no instructions, there are only general descriptions about the settings. I contacted the creator, and he briefly explained to me what and how, but I couldn’t set it up (due to my lack of knowledge on Linux systems). I quote

it is required that the client library in the
operating system that sends a DNS query to the network strictly
complies with the RFC in terms of handling truncated requests. For
popular linux distributions, this was not at all the case some time ago
, but you can raise a local caching bind so that it goes outside for DNS
over TCP, receives responses and gives them to the operating system library.

After that, I asked if it is enough for the DNS server to respond over TCP instead of UDP? What was the answer

Didn't _answer_ over TCP, but _went to the Internet for an answer_ over TCP. I don’t know
if it is possible to explicitly specify in forwarders the requirement to go via TCP to the
upstream DNS server, but earlier it was possible to send outgoing UDP requests from
bind to dnstc and after that it tried again via TCP.

I thanked him for his help, and went away for a few weeks (due to unforeseen circumstances), but when I started setting up, and again turned to him for help, he disappeared somewhere. And how long it will last is unknown. Therefore, I turn to you for help in solving this problem. What was done? - the local caching Bind9 is raised, the address of the upstream DNS server is specified in the forwarders line, then the iptables rules are specified: iptables -t nat -A OUTPUT -p udp --sport 53 -j REDIRECT --to-ports 5300 and iptables -t nat -A OUTPUT -s 127.0.0.1/32 -p udp -m udp --sport 53 -j REDIRECT --to-ports 5300. 'dnstc' hangs on port 5300, 53 - Bind, respectively. (If necessary, I will send the named.conf file or any other settings). And in the end, nothing has changed. My ip remained the same, and the response fluctuated within the normal range, although there should have been a slight delay in the responses from the DNS servers. Regarding the filtering of TCP traffic, everything is in order, redsocks filters, there are no complaints, so I decided to omit this topic. Tell me what I did wrong? Where did I make a mistake? Maybe someone faced a similar situation?

Answer 1

DNS SOCKS Proxy, https://github.com/jtripper/dns-tcp-socks-proxy

Answer 2

server 127.0.0.1 {
    tcp-only yes;
};