3

I am trying to use zone forwarding, but only for subdomains.

Imagine that you have an VPN server at the domain vpn.provider.tld. This domain is pointing to an global IP address, accessible from the internet and provided by global DNS server. Inside the VPN (intranet) there is a DNS server at local address (VPN_DNS_LOCAL_IP, ie. 10.0.0.1). The VPN DNS server contains records *.vpn.provider.tld pointing to an internal VPN addresses. For ie. host.vpn.provider.tld -> 10.0.0.2.

My goal is to configure an PDNS recursor on a VPN host to forward the zone vpn.provider.tld to an internal DNS server at VPN_DNS_LOCAL_IP. But when the forward is configured as:

forward-zones=vpn.provider.tld=10.0.0.1

the host is unable to connect to the VPN server, because the vpn.provider.tld is forwarded to an unaccessible internal VPN IP.

Is there any way to forward ONLY *.vpn.provider.tld to the VPN DNS local IP and to leave the vpn.provider.tld to be resolved globally to the global IP address?

1
  • did you ever solve that issue? I got that problem myself now, wanting to point wildcard-subdomain to a private IP, while the internet (letsencrypt) sees a public ip. and I already have a pdns-recursor running
    – sgohl
    Mar 7, 2019 at 22:12

1 Answer 1

1

While hard to do in the Recursor, this is easy with dnsdist.

  1. take just vpn.provider.tld and hand it off to your usual resolver, using https://dnsdist.org/rules-actions.html#QNameRule
  2. hand off everything else inside vpn.provider.tld to the VPN DNS server, using https://dnsdist.org/rules-actions.html#SuffixMatchNodeRule

For (2), makeRule will save you some typing.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .