1

I am attempting to define a subdomain for a private network (RFC1918) behind a NAT firewall; let's call it priv.example.com. Normally, and from what I can gather on various websites, this could be done by delegating the subdomain from the public and external DNS server for example.com to another DNS server that is internal and authoritative for priv.example.com.

I have a couple problems to overcome with this solution, however. The first is that I don't need or want the public Internet to be aware of priv.example.com. I suppose this could be handled with bind views, but I haven't quite figured this out yet (nor am I sure whether our DNS host supports views). The second is that I would have to open a hole in the firewall and create an address translation so the external DNS server can see the internal one. This seems like an unnecessary security risk.

Is there a way to create this scenario without making the public DNS server for example.com aware of the private DNS for priv.example.com? I am using bind9 for the internal, private server. Is there a better overall solution to provide name service for my private network? I've seen other, more controversial, solutions such as using a private TLD or defining a duplicate "master" DNS for the second-level domain within the private network. These seem like ugly hacks to me.

Improve this question

3 Answers 3

Reset to default
0

You need to have all systems inside the network resolve to an internal DNS server.

Once all hosts are using the internal DNS server, you can either define the subdomain as a zone, as mulaz suggests, or use DNS Forwarding - allowing you to pick and choose what hosts to override, and letting the rest be resolved externally. Either way, the internal DNS server would relay (and cache) any requests it doesn't know about (such as google.com).

Improve this answer
1
  • I had forwarders defined, so it appears that everything was configured correctly already. To get everything to work, I just had to remove the example.com zone from named.conf. I had added it because something wasn't working right without it. I must have changed something else later that made it unnecessary to define this zone. I've tried too many combinations to remember what caused what problem!
    – Schparky
    May 10, 2012 at 23:13
2

Which dns server (resolver) do the computers in your local network use? If they use the internal bind server you administer, you can just set up the zone for your domain, and add the appropriate records for your internal services. The dns server will still work normally as a resolver for getting outside addresses, but will serve local zones to local users for your local domain.

Of course all the computers will have to use the dns server you set up for them, and not other dns servers (like opendns, google etc.)

Improve this answer
1
  • I have it set up as you describe, and it works -- mostly. The remaining problem is that internal DNS requests for hosts on the primary domain (e.g. www.example.com) fail. ` $ nslookup gw Server: 192.168.16.8 Address: 192.168.16.8#53 Name: gw.priv.example.com Address: 192.168.16.1 $ nslookup www.example.com Server: 192.168.16.8 Address: 192.168.16.8#53 ** server can't find www.example.com: NXDOMAIN `
    – Schparky
    May 10, 2012 at 22:44
1

You can configure Bind with split DNS. You would then have two separate zone files for the domain. The one to be served to the public would contain only the records you wish to have publicly available. The zone file for the same domain to be served internally would contain the same information plus any additional resources you want available to internal clients. This internal zone file could also serve the internal addresses for resources, rather than the public address, as appropriate.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .