0

It is suggested in this question that it's not a good idea to expose a private IP address via a public DNS entry. My question is then what's an elegant and easily maintainable way to allow multiple users on diverse platforms (Mac/Windows) connecting to a VPN to use a standard centralized address naming schema without asking them all to hack their hosts files (which really isn't an option in my case)?

Clarification: I've set up several services on the private network like Cacti and I want to let internal users access these services via http://cacti.our-domain.com so they don't have to type/remember/bookmark the private VPN-only IP addresses.

Improve this question
1
  • It's also said in that question that it's not a bad idea. I still say just stick the names in the public DNS and be done with it.
    – womble ♦
    Oct 7, 2009 at 3:19

3 Answers 3

Reset to default
2

Use DNS.

If you're concerned about public access to names that resolve to private addresses, you can either run an internal DNS server that's publicly inaccessible that forwards to a more general-purpose DNS server, or use a DNS server that will restrict access to parts you don't want people to see.

Improve this answer
2
  • "...you can either run an internal DNS server that's publicly inaccessible..." - please forgive my ignorance of how VPNs and DNS work but when I connect to a PPTP VPN can/does it use a DNS server specific to that connection for requests that go down that pipe? or would I have to set up DNS entries on each client machine (which is a deal breaker)? Thanks.
    – Teflon Ted
    Oct 15, 2009 at 13:20
  • It depends on the VPN client, unfortunately. Some have that feature; others don't.
    – wfaulk
    Oct 15, 2009 at 14:17
0

I'm not exactly sure what you're asking.

We have VPN and it exists on a public IP address with no specific DNS entries for it...the users have to put in the ip address in the address bar.

The internal DNS server gives them access to local resources by name w/out exposing the names to the outside world.

Improve this answer
0

I just had a look at the question you posted to, and whilst it's not really abiding by any particular convention, as they said, security through obscurity is not really security.

As stated in your previous question, without setting up an internal DNS on your network (if you have an AD you already an internal DNS mind you), there's pretty much no way of doing it.

Just put it in your public DNS and be done with it ;)

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .