1

Say I have a website www.example.com. The external DNS entry points visitors to 111.22.33.44 which in turn points to my internal web server 172.1.2.3. All internal visitors use an internal DNS entry that points them directly to 172.1.2.3.

My web server serves 100 websites. Adding a new one requires me to add an internal DNS entry and an external DNS entry. If I ever change web servers then this is 100 * 2 changes I have to make. I'm debating removing them and just having the internal users use the external entries ... keep it simple, less work etc. I've never noticed any differences in performance when some of my websites don't have internal DNS entries.

Could someone explain the main benefits of having internal DNS entries?

(Terminology may be a little confused, I'm usually a programmer)

Edit

My server is behind a firewall (ASA I think). 111.22.33.44 is the external address. 172.1.2.3 is the internal address.

2
  • ... How often do you change web servers? May 17, 2013 at 11:04
  • @IgnacioVazquez-Abrams How often? Once every few years. Last time? 4 days ago! May 17, 2013 at 11:51

3 Answers 3

2

Could someone explain the main benefits of having internal DNS entries?

That's a very broad question, and depends upon your requirements and IT infrastructure.

In a large enterprise it could be that a request from a user in one department would have to transit multiple routers and/or firewalls to access the public (NATed) IP of a web server that's sitting in a data room a few feet away from them. In other words, it could represent an inefficient use of network resources, and so it would be more desirable to have internal users' requests go to the internal IP of the server.

Another case could be that internal users are allocated a specific web server (or cluster) that may serve the same content as server(s) on the public IP for the same hostname.

Yet another case could be that internal users would put an unacceptable load on the router(s)/firewall(s) that provide the NAT between the internal and external addresses, and having them connect directly to the internal IP of the server would alleviate that load.

In another case the configuration of the firewall (and/or router) may not allow traffic from the internal user IPs to the external IP of the server in question, and so the users need to be directed to the internal IP of the server.

From what you describe, your firewall does allow internal users to access the external IP address(es) of your server. Generally speaking, if your internal users do not represent a significant load (relative to the load of external users and the capabilities of your networking equipment), it seems like there is no practical reason for you to maintain separate DNS entries for all of your public hostnames.

However, who implemented your current configuration? They might have had a specific reason for doing so, which may render my last paragraph moot. I would need more information about your network environment and loads before I could render a decent opinion.

1

If your website is hosted internally, users won't be able to reach your web server depending on how its hosted. Is the server located behind the same firewall or NAT? If so it won't work properly...it wasn't completely clear in your question if users could reach it via IP.

Also, depending on the DNS server, making mass changes is easy. In BIND, you can just find/replace the IP, update the serial, then reload the zone. I'm sure with others there's similar methods or tools that allow mass changes.

6
  • Is the server located behind the same firewall or NAT? If so it won't work properly that's not true. Plenty of SOHO routers won't hairpin NAT properly, but things like ASAs and similar can be configured to work properly in this situation.
    – MDMarra
    May 17, 2013 at 11:43
  • True, but it's a point to bring up since we don't know his network layout.
    – Nathan C
    May 17, 2013 at 11:44
  • I get your point about internal sites. Almost all of my websites are external (the internal ones will obviously look at the internal dns). Currently there are a few websites that don't have an internal dns entry and they work fine. Pinging the site gives the external address. May 17, 2013 at 11:44
  • If it works properly then you probably don't even need internal DNS entries. I don't see any performance gains by doing this really.
    – Nathan C
    May 17, 2013 at 11:45
  • @MDMarra I've heard talk that we use an ASA. I'm not in control of the actual DNS entries, I just want an idea of the real benefits of using internal dns entries for external websites May 17, 2013 at 11:46
1

Ultimately, it boils down to the network devices you end up traversing on the inside of your network to get to the webservers. Usually the performance gain is negligible from a desktop perspective, but what happens when some of those devices go down? What is your worst case scenario when those public IPs become unroutable or suffer degradation? (failing API calls between webapps that could have been avoided, etc.)

The circumstances are different for everyone, so ultimately it's up to you and your coworkers to discern what the impact will be of having your internal traffic following one path vs. another. (and whether it's worth managing that problem at the DNS layer; I know few people professionally who enjoy split DNS configs)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .