Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

It is suggested in this question that it's not a good idea to expose a private IP address via a public DNS entry. My question is then what's an elegant and easily maintainable way to allow multiple users on diverse platforms (Mac/Windows) connecting to a VPN to use a standard centralized address naming schema without asking them all to hack their hosts files (which really isn't an option in my case)?

Clarification: I've set up several services on the private network like Cacti and I want to let internal users access these services via http://cacti.our-domain.com so they don't have to type/remember/bookmark the private VPN-only IP addresses.

share|improve this question
    
It's also said in that question that it's not a bad idea. I still say just stick the names in the public DNS and be done with it. –  womble Oct 7 '09 at 3:19

3 Answers 3

up vote 2 down vote accepted

Use DNS.

If you're concerned about public access to names that resolve to private addresses, you can either run an internal DNS server that's publicly inaccessible that forwards to a more general-purpose DNS server, or use a DNS server that will restrict access to parts you don't want people to see.

share|improve this answer
    
"...you can either run an internal DNS server that's publicly inaccessible..." - please forgive my ignorance of how VPNs and DNS work but when I connect to a PPTP VPN can/does it use a DNS server specific to that connection for requests that go down that pipe? or would I have to set up DNS entries on each client machine (which is a deal breaker)? Thanks. –  Teflon Ted Oct 15 '09 at 13:20
    
It depends on the VPN client, unfortunately. Some have that feature; others don't. –  wfaulk Oct 15 '09 at 14:17

I'm not exactly sure what you're asking.

We have VPN and it exists on a public IP address with no specific DNS entries for it...the users have to put in the ip address in the address bar.

The internal DNS server gives them access to local resources by name w/out exposing the names to the outside world.

share|improve this answer

I just had a look at the question you posted to, and whilst it's not really abiding by any particular convention, as they said, security through obscurity is not really security.

As stated in your previous question, without setting up an internal DNS on your network (if you have an AD you already an internal DNS mind you), there's pretty much no way of doing it.

Just put it in your public DNS and be done with it ;)

share|improve this answer
    
Sorry, what's an AD? –  Teflon Ted Oct 6 '09 at 20:40
    
Active Directory –  Mark Henderson Oct 6 '09 at 20:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.