3

This question is related to this one but with a twist. I have many LANs that I manage and would like to have DNS entries for the machines in those LANs. For example, let's assume:

LAN A - is 192.168.128.X (with external IP 200.90.89.2)
  snoopy is 192.168.128.2
  router sends port 80 on 200.90.89.2 to 192.168.128.2

LAN B - is 192.168.130.x (with external IP 201.32.59.2)
  charlie is 192.168.130.4
  router sends port 80 on 201.32.59.2 to 192.168.130.4

The DNS would be for mydomain.com (outside all LANs) and I would like to register snoopy.mydomain.com and charlie.mydomain.com. Whenever I'm in LAN A the DNS for snoopy.mydomain.com would resolve to 192.168.128.2 and whenever I'm not it would resolve to 200.90.89.2. Same for LAN B.

The problem is that the DNS server will be outside all LANs and yet it must know if the request is coming from inside any of the LANs.

Improve this question

2 Answers 2

Reset to default
6

What you're talking about is a split view. Split view DNS was originally designed to provided a fig-leaf of security (to prevent attackers from getting a full map of your internal hostnames) but it can also be used (and abused) in nefarious ways - including setting up separate responses with answers that depend on who asks the question...

Improve this answer
3
  • What about when the external IPs for each LAN are dynamic? I won't know if the packet is coming from inside one of the LANs.
    – Ricardo Marimon
    Jul 29, 2009 at 5:40
  • Inside IPs are fixed. So if request is not from inside, then it is from outside. Let outside IPs be dynamic that should not stop you from using split view.
    – Saurabh Barjatiya
    Jul 29, 2009 at 8:17
  • The idea behind the split view is that "for a given subnet X I will return answers from a set of interior zone files" and "subnets that are not a part of X will receive answers from a different set of external zone files". So it's a matter of partitioning what addresses get what answers.
    – Avery Payne
    Jul 29, 2009 at 18:12
0

I can think of a way to 'hack' around this by running a separate DNS server that is bound to different interfaces, one bound to your internal interface while the other is bound to the external interface. Then, you just need to configure them slightly differently.

Improve this answer
1
  • The thing is that the DNS will have to live outside the local network.
    – Ricardo Marimon
    Jul 29, 2009 at 15:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .