Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working on a network restructure that has three geographical locations, but will share some services. Two of the locations have workstations, and one has only servers (in a CoLo facility). We will be running PfSense firewalls, and several hosts will provide services inside the LAN and through port-forwards to the internet.

It doesn't seem like it would be worth the hassle to run 4 different DNS views in bind, but it sounds like the load and configuration overhead in PfSense to utilize NAT Reflection would be considerable. What are the caveats to each, or is there another option?

share|improve this question
up vote 4 down vote accepted

After getting PfSense installed and running, it turns out that this is a non issue; I can keep the DNS records the same everywhere, and use PfSense's DNS Forwarder and Override to filter and fix the addresses for hosts located on the same private network. Win!

share|improve this answer

How about setting up one domain per host? We use :


Where there is a 3 letter code for each location. So when the user hits "mail" for example, it will use the domain to resolve the local mail host . Sometimes CNAMES are used across domains when there is only one central version of a service.

Both NAT reflection and split-DNS are possible to do and will solve your problem but they are more complex to maintain and trickier to debug.

Stupid question but - why do you need to serve different DNS results anyway? Is there a star topology VPN between all the sites or to the colo from all sites and can't you therefore resolve the same IPs in each zone?

share|improve this answer
The three letter issue doesn't really help, because what I need is private vs. public ips, dependent on whether the service is behind the same firewall as you, and therefore NATed. Since servers reside in three locations, there is the internet view, and three others. There is not currently a VPN in place, though I'm considering that as well. – Bryan Agee Jun 1 '11 at 3:04
I think this is overly complicated. Serve everyone internal IPs using DNS and have the routers know how to reach those internal IPs via VPN if necessary. – hellomynameisjoel Jun 6 '11 at 7:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.