0

We have an intranet webserver https://intranet.example.com that should be accessible from outside (only for our own people) under the same domain name. This is necessary, so all the links and urls work everywhere the same (links that are posted to the intranet, links in bookmarks, etc). One resource should have only one link and not 2.

Let's say the internal IP of the Apache https server is 10.1.1.100 and this is also opened with a NAT rule to the external WAN interface 80.81.82.83

To have the same domain name in the LAN and also outside, the name intranet.example.com has a "real" DNS entry at the hoster of 80.81.82.83, but on the Intranet DNS we declared it 10.1.1.100

This seems to work on some test machines now both from the LAN and the WAN. If someone from outside with a laptop comes into the office and switches from mobile access to LAN he gets the internal DNS entry from DHCP and will have resolved intranet.example.com to 10.1.1.100

I have chosen a low TTL for the DNS entry of 10 minutes and I hope this will work.

Do you have a better solution? What is best practice?

Would it be possible to make the outside IP 80.81.82.83 also accessible from the inside? This doea not work normally, but can we convince our gateway machine somehow?

2 Answers 2

1

What you are proposing works just fine. Whether or not you can eliminate the split DNS and access the server by its public address from the LAN will depend on the systems you have between the Internet and the server. e.g. Some firewalls are happy to do this, while others won't permit it.

The VPN, as proposed by gtirloni may or may not be required. It really depends on how you secure the system and what authentication method(s) you use. With decent authentication SSL will be quite adequate for all but the most paranoid. However, if you have any concerns on that score then I agree that you should play safe and use a VPN.

3

The requirement that this be only available to your employees makes a VPN the best option. That's how most companies do it. Use something like OpenVPN and assign a special range of internal IPs to people connecting from outside (that way you can filter them separately).

If you expose the internal website through NAT, other people will be able to see confidential information and/or you'll have to deploy complex encryption and authentication mechanisms. With a VPN not only you grant access to the intranet website, but also to other resources that you think are needed (create firewall rules as necessary). And it's all encrypted.

3
  • Agree, don't open internal things to the external world - that's just asking for people to crawl in.
    – Marm0t
    Nov 4, 2010 at 6:07
  • Yes, VPN would be better than https / http auth. But we are trying to establish an intranet blog and we do not have the resources to install vpn on all devices. The employes should be able to use their home and mobile devices without modification. In fact the Blog is isolated from the rest of the company LAN. What are the flaws of https you think?
    – mit
    Nov 4, 2010 at 11:31
  • 1
    HTTPS is fine if you use some kind of user authentication.
    – gtirloni
    Nov 6, 2010 at 22:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .