I have public DNS for company domain (example.org, for example) on DNS hosting service. And I have local DNS server (BIND) in office which forwards public DNS. In office I have servers which provide services (web, mail, etc) in public domain and also have local IP addresses.

I want to give access for public domain from office throught local IP addresses of servers.

For example. In public DNS I have A record mail.example.org ->, which should be translated in local DNS to mail.example.org -> I.e. when client from office will request IP for mail.example.org, local DNS server (BIND) will request this from public DNS and replace IP in answer if this IP in special list (list of servers public IPs with local IPs).

Is there any way to replace IP in DNS answer for several IPs in BIND server?

The best way is to replace exactly IP in answer and not to generate public zones for local IPs on local DNS.


you need to run an internal only dns server or similar, you can setup bind with "views" to return one set of results if request comes from a certain ip but its often simpler to do a dual dns setup but that requires maintenance of both zones if an external IP changes

PFsense firewall does a nifty dns forwarder feature that allows you to only override individual dns A records on demand rather than requiring the full dns zone being present on your internal dns server

| improve this answer | |

If you're using bind, it actually has a feature called 'views', that allow information to be separated based on some ACLs. This link provides the details: http://www.bind9.net/manual/bind/9.3.2/Bv9ARM.ch06.html#id2562349

| improve this answer | |
  • This not good because we have not production sever machines in office and public servers connected with office LAN by OpenVPN tunnels throught internet from data center. – Nikita Petrov Aug 12 '11 at 12:06
  • Then it might actually be easier to solve this issue at workstation level by altering the 'hosts' file for each workstation (/etc/hosts in Linux, %WINDIR%/System32/drivers/etc/hosts for Win2k and later). – O G Aug 12 '11 at 12:18
  • 1
    Hosts File Considered Harmful! (How will you maintain them? They aren't centralized.) - Views are the Right Solution here - they were made expressly for this purpose. If necessary you can override each DNS entry as its own zone - this is messier than using views as intended, but at least it's centralized. – voretaq7 Aug 12 '11 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.