3

Our office has a private network, where any requests on a (pre-determined) public IP are forwarded to a private IP inside said network. On that private IP, we've got a server running several services, including HTTP servers, and SCM systems. We only control our private network, having no control on the public IP configuration.

We bought a domain name, and pointed it to that public IP, so people can access our services from the outside. But, when inside the office, people can't use that DNS name, because the server and any other hosts inside the network share the same public IP!

For desktops, inside the office network, dealing with names is really easy: one entry on the hosts file and we're done. However, for laptops, that keep going in and out, and need to access services inside the office, the naming is really annoying.

I don't know the "standard" process for dealing with these kind of situations. I've considered installing BIND in the office, and make people configure their wireless and wired connections to use that DNS server.

What is the correct approach in this situation? If using BIND (or any other DNS server) is the answer, how should I configure it so that people inside the office can use it to get our custom names, and get forwarded to the ISP DNS when trying to reach the internet?

  • The server which gets all the requests that are forwarded from the public IP, is a Virtual Machine with 4 cores available and 16 GB of RAM, "hosted" on a VMware ESXi 4.1 server (total 48GB of RAM, 8 cores). The office network counts with 10 permanent hosts, and at least another 5 that might appear from time to time.
  • I need practical examples of configuration. Only the most relevant ones, of course. And, if there are multiple ways of solving the problem, please explain which is better given the context.
  • All the infrastructure relies on Linux systems. Namely, Ubuntu latest versions.
Improve this question
5
  • Are you running Active Directory on the network already?
    – mrdenny
    Jun 24, 2012 at 16:16
  • I'm running only Linux systems for the server parts. The user desktops are both Windows and Linux. I have no Active Directory.
    – thyandrecardoso
    Jun 24, 2012 at 17:02
  • Then a bind DNS server would be the way to go.
    – mrdenny
    Jun 24, 2012 at 17:07
  • What about the other alternative suggested here? The NAT thing...?
    – thyandrecardoso
    Jun 24, 2012 at 17:21
  • Doing the NAT option requires access to the router and the ability to change the network configuration.
    – mrdenny
    Jul 1, 2012 at 13:11

5 Answers 5

Reset to default
1

I guess bind is too complicated for your needs, consider using dnsmasq. dnsmasq is pretty simple: it takes internal dns-names from the host-file its running on. Other dns-requests are handed to the upstream dns-server. So install it on your default-dns-server in the company thats it.

Result: There is no need for maintaining host-files on your clients. If they are on the internet they resolve through their normal dns-servers, if they are in the company they resolve through dnsmasq.

Improve this answer
3
  • I can't install it on the "default-dns-server". The DHCP server from the office, belongs to the entire building, and gives information for computers to connect to the ISP's dns server. I would need to tell users to overwrite their default dns servers.
    – thyandrecardoso
    Jun 24, 2012 at 11:19
  • I went search in google for dnsmasq. It really seams simple. And everyone here speaks about setting up a DNS server... But no one explains the other alternative (configuring NAT) and which is most appropriate in this context. I'd like to have a clear explanation about these two options before accepting yours (which seems the best for setting up a DNS server).
    – thyandrecardoso
    Jun 24, 2012 at 17:17
  • A bit of followup on this: I successfully installed dnsmasq BUT I had a bit of trouble for correctly setting up names without dots ('.') on them, like 'server1'. dnsmasq was always redirecting the request for the next dns server... The solution is detailed on the FAQ: thekelleys.org.uk/dnsmasq/docs/FAQ ("Names on the internet are working fine, but looking up local names from /etc/hosts or DHCP doesn't seem to work.")
    – thyandrecardoso
    Jul 12, 2012 at 14:31
6

Bind is indeed he answer, though setting it up correctly can be challenging. What you need is called "split dns", which is where you have different names and ip addresses depending on whether or not the person is inside your lan.

You can also make sure your router does nat loopback (it goes by half a dozen different names) so the public ip still works from inside the lan.

Improve this answer
1
  • Ok, "split DNS" rings a bell from the Systems and Network classes :)! But I did not understand the second part: what "router"? Is this an alternative? Why is Bind better over your second alternative? And still, I'd need some practical examples. Thanks!!
    – thyandrecardoso
    Jun 24, 2012 at 11:15
1

At least you know your problem is local users are being sent to a public IP.

A few options exists

  • get the public ip to be routed to the local server when used within the lan. Do this with NAT, outgoing requests on LAN to public IP get forwarded to local IP of the server. Problem with this is all requests must go through the router and wont utilize any switches.
  • Get local DNS, this can be done with BIND servers, or a good desktop that isn't used much can be installed with maraDNS. You will need to change the DNS server IP provided by your routers during DHCP.
    • manually edit the host file on each machine. Do this will scripting, group policy(maybe).
Improve this answer
4
  • I reckon this is same as Grant's answer! Mostly I need examples. How to accomplish the "NAT" part? I would need to make users overwrite their "default gateway"? That server is in reality a VM with 16GB of RAM, and 4 cores --> would NAT represent a CPU load?
    – thyandrecardoso
    Jun 24, 2012 at 11:22
  • nat affects the gateway to your network..akaa router so no its adds no CPU load on serer and clients. If the routing device is just a basic home router then you probably cant do this advanced NAT configuration unless you put ddwrt on it. Like i said the easiest ad best solution is local DNS.
    – Graham.Fraser
    Jun 24, 2012 at 17:55
  • I have no access to the router. I just have an "IP range" which I can use as I want. I just put a server with the (private) IP that receives the forwarded requests from the public IP. So, shouldn't I be doing that on this server, and change everyone's default gateway to that same server? Transforming it on the office "router"?
    – thyandrecardoso
    Jun 24, 2012 at 18:05
  • nononono server---router separate things. Do you want this server to be accessible from the internet and the Local Area Network(LAN)? if yes then your only option in DNS. If your in an office thats publishing servers then they 'should' have some DNS server up and running. Ask around the office for help. If this is a home-based thing then you have access to you router.
    – Graham.Fraser
    Jun 24, 2012 at 18:27
1

You definitely need your own DNS server.

Once you have your own DNS server, then you can edit your client's network configuration to accept the your building's DHCP configurations, but have the DNS point to your own DNS server thereby not accepting the DNS server distributed by the DHCP server.

Your own DNS server can then connect to whatever external DNS server you want to set up.

You did not specify what OS you are using, so I can't really give you specific details, but I followed this to set up my own DNS server: http://ubuntuforums.org/showthread.php?t=236093

If you do not use Ubuntu, then you can tailor the steps to your OS... Bind should be the same configuration (for the most part) no matter what OS you use... You seem to know what you are doing, I'm sure you can easily figure it out.

EDIT: Your clients will always connect to your own DNS server. Your DNS will connect to the external DNS only.

Improve this answer
1

If you are using windows, in DNS on your domain controller simply add the domain and it will take precidence over the public DNS.

Improve this answer
1
  • I'm not using Linux. It's my bad for not including the OS on the question. I'm sorry for that, I just edited the question to encompass that information.
    – thyandrecardoso
    Jun 24, 2012 at 17:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .