Different Routes For The Same DNS

Question

I don't know the right term for this concept. But basically, I just want to reroute internal traffic to go directly to a server within the network instead of going around the internet. The domain have to be the same.

Example:

- (for internal users) site.domain.com --> 10.0.0.1
- (for external users) site.domain.com --> 111.222.111.12

These are the constraints I have:

• the domain needs to be the same.
• the system is not configurable to work with more than 1 domain.
• we're on a microsoft network.

---

I saw this post recently, but it's old. There's probably a solution for this now.

Resolve the same DNS name to different IPs depending on client IP network

I would appreciate any advice.

Thank you!

Answer 1

You need to use a "Split DNS" setup. Essentially, you have one one DNS server for external requests/users and one DNS server for internal use. The external DNS server points things to your public facing IP's, and the internal DNS can use your private IP range.

How exactly you accomplish this will depend on exactly what you're doing, though.

Here is a nice, though dated primer on the idea:

http://www.isaserver.org/tutorials/you_need_to_create_a_split_dns.html

Answer 2

Yes, the link you provided is a good one. It is called views in bind DNS server. It seems not possible using Microsoft DNS server.

In bind, the same zone is defined twice: one with public IPs and another with private IPs. The DNS server is then configured to use each one based on the clients source IPs.

Answer 3

You need your internal DNS server. Though, since your DNS handled by 3-rd party, you don't really need your internal server to support views. Install any server like BIND or SimpleDNS Plus, or use Microsoft one (I'm not into windows, don't know how it works). Create zone for domain.com using you internal addresses, and allow it to be recursive server for all other domains.

Then you will have to point all your PCs to use this new server as their only DNS server, either using DHCP, via your router settings or with manual configuration on each PC.

Answer 4

For internal users, set them all to use your local DNS server. This option can be set in DHCP. Make sure the local DNS server has an A record for the internal IP of your server hosting the website, and not the public one.

Your domain name is managed by some registar. If it's someone like GoDaddy/Verio/NetworkSolutions, then they have their own name servers. Do a WHOIS lookup on your site and it should list the name servers. If you haven't changed them, then they are managed by your domain registar. From your domain registar's config page, you should have an option to manage DNS records. This is the public authoritative DNS server for your domain. Enter the public IP of your site here.

External users, assuming they are outside of your subnet, will end up querying the authoritative name server since their local DNS server wherever it is they are working at won't know the IP of your website. They will then be given the public IP.

When internal users try to access the site, they query the local DNS server first. Since it has an A record for the site, that will be given back so they will not be going over the internet.

A third option is to create a NAT loopback rule on your firewall. For Sonicwall's, it would go something like this:

For all traffic originating from a firewalled subnet that is trying to access the public IP of the website, reroute traffic to the internal IP of the website instead.