This question is related to this one but with a twist. I have many LANs that I manage and would like to have DNS entries for the machines in those LANs. For example, let's assume:

LAN A - is 192.168.128.X (with external IP
  snoopy is
  router sends port 80 on to

LAN B - is 192.168.130.x (with external IP
  charlie is
  router sends port 80 on to

The DNS would be for mydomain.com (outside all LANs) and I would like to register snoopy.mydomain.com and charlie.mydomain.com. Whenever I'm in LAN A the DNS for snoopy.mydomain.com would resolve to and whenever I'm not it would resolve to Same for LAN B.

The problem is that the DNS server will be outside all LANs and yet it must know if the request is coming from inside any of the LANs.


What you're talking about is a split view. Split view DNS was originally designed to provided a fig-leaf of security (to prevent attackers from getting a full map of your internal hostnames) but it can also be used (and abused) in nefarious ways - including setting up separate responses with answers that depend on who asks the question...

| improve this answer | |
  • What about when the external IPs for each LAN are dynamic? I won't know if the packet is coming from inside one of the LANs. – Ricardo Marimon Jul 29 '09 at 5:40
  • Inside IPs are fixed. So if request is not from inside, then it is from outside. Let outside IPs be dynamic that should not stop you from using split view. – Saurabh Barjatiya Jul 29 '09 at 8:17
  • The idea behind the split view is that "for a given subnet X I will return answers from a set of interior zone files" and "subnets that are not a part of X will receive answers from a different set of external zone files". So it's a matter of partitioning what addresses get what answers. – Avery Payne Jul 29 '09 at 18:12

I can think of a way to 'hack' around this by running a separate DNS server that is bound to different interfaces, one bound to your internal interface while the other is bound to the external interface. Then, you just need to configure them slightly differently.

| improve this answer | |
  • The thing is that the DNS will have to live outside the local network. – Ricardo Marimon Jul 29 '09 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.