Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This question is related to this one but with a twist. I have many LANs that I manage and would like to have DNS entries for the machines in those LANs. For example, let's assume:

LAN A - is 192.168.128.X (with external IP 200.90.89.2)
  snoopy is 192.168.128.2
  router sends port 80 on 200.90.89.2 to 192.168.128.2

LAN B - is 192.168.130.x (with external IP 201.32.59.2)
  charlie is 192.168.130.4
  router sends port 80 on 201.32.59.2 to 192.168.130.4

The DNS would be for mydomain.com (outside all LANs) and I would like to register snoopy.mydomain.com and charlie.mydomain.com. Whenever I'm in LAN A the DNS for snoopy.mydomain.com would resolve to 192.168.128.2 and whenever I'm not it would resolve to 200.90.89.2. Same for LAN B.

The problem is that the DNS server will be outside all LANs and yet it must know if the request is coming from inside any of the LANs.

share|improve this question

2 Answers 2

What you're talking about is a split view. Split view DNS was originally designed to provided a fig-leaf of security (to prevent attackers from getting a full map of your internal hostnames) but it can also be used (and abused) in nefarious ways - including setting up separate responses with answers that depend on who asks the question...

share|improve this answer
    
What about when the external IPs for each LAN are dynamic? I won't know if the packet is coming from inside one of the LANs. –  rmarimon Jul 29 '09 at 5:40
    
Inside IPs are fixed. So if request is not from inside, then it is from outside. Let outside IPs be dynamic that should not stop you from using split view. –  Saurabh Barjatiya Jul 29 '09 at 8:17
    
The idea behind the split view is that "for a given subnet X I will return answers from a set of interior zone files" and "subnets that are not a part of X will receive answers from a different set of external zone files". So it's a matter of partitioning what addresses get what answers. –  Avery Payne Jul 29 '09 at 18:12

I can think of a way to 'hack' around this by running a separate DNS server that is bound to different interfaces, one bound to your internal interface while the other is bound to the external interface. Then, you just need to configure them slightly differently.

share|improve this answer
    
The thing is that the DNS will have to live outside the local network. –  rmarimon Jul 29 '09 at 15:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.