0

I have a network configuration like the one pictured here:

Network configuration

There is one machine facing the Internet, with a static IP assigned, and a group of machines having only local addresses.

Each "private" machine runs a DNS server, each resolving a couple of domains. Let's say that we have something like this:

Machine 192.168.1.2

example1.com A 192.168.1.2
example2.com A 192.168.1.2

Machine 192.168.1.3

example3.com A 192.168.1.3

Machine 192.168.1.4

example4.com A 192.168.1.4

The public-facing server also runs a DNS server. It should work as proxy for all the internal servers, aggregating their zones and translating the address to the public one. So it should respond to DNS queries with something like this

Machine 123.123.123.123

example1.com A 123.123.123.123
example2.com A 123.123.123.123
example3.com A 123.123.123.123
example4.com A 123.123.123.123

Is it possible to accomplish something like this, considering that I have no control over the "private" machines? They can be considered black boxes, that are not aware of the "proxy" server

  • 1
    123.123.123.123 should response to internal clients (192.168.1.2/3/4) only or to anyone? And who are the authoritative servers for zones exampleX.com in your environment? – ALex_hha Jul 20 '13 at 18:22
  • 123.123.123.123 should respond to everyone and, for what the public internet is concerned, should behave as the authoritative server for the domains. Basically, what I'm trying to do is proxying a couple of services hosted on the internal servers (web, ftp, smtp/imap) using only one exit IP. The world-facing machine will be set as authoritative NS for the domains and it will get all the incoming traffic for the various services. The proxies for the various protocols will then be configured to route the requests among the internal servers. – Michele Piccirillo Jul 20 '13 at 18:56
  • If I understood you correctly, you could play with view in bind – ALex_hha Jul 20 '13 at 20:20
3

You could probably set up your DNS server to use conditional forwarders, pointing at the other DNS servers, for the domains you want it to resolve. This is not completely transparent, but it will pass the queries through and the results back.

Otherwise, you would have to configure a load balancer to inspect the queries and send them to the right server. I don't know of any load balancer which would support this, though you could construct one with iptables and layer 7 filtering, using DNAT to redirect the queries and SNAT to "proxy" them.

|improve this answer|||||
  • Thank you for your answer. Could you point me to some resources that I could use as base to start studying a solution like the one you described here? – Michele Piccirillo Jul 20 '13 at 19:21
  • 1
    Google "conditional forwarding" – Mathias R. Jessen Jul 20 '13 at 19:30
1

This sounds like a job for dnsmasq ( http://www.thekelleys.org.uk/dnsmasq/doc.html ) which makes it easy to define authoritative servers for different domains. For example, if example1.com DNS is on 192.168.1.2 you could tell dnsmasq --server=/example2.com/192.168.1.2.

dnsmasq provides various methods for aliasing addresses - it can convert internal addresses into external addresses (which I don't think is likely needed here). It can act as a general resolver, or just as an authoritative server. And, you can bind it to various interfaces or ports. For example, we use dnsmasq on port 53 as a front end to our internal bind/named servers on 5353 to do various inserttions and translations.

dnsmasq is used in many firewalls and gateways, and is (one might say) the DNS Swiss army knife.

|improve this answer|||||
0

Assuming Unix/Linux boxes (Windows should be similar):

  1. In the world-facing DNS server, include only the information that you want the outside world to see.
  2. The gateway machine should use the internal DNS servers for resolving (i.e., put the internal DNS servers in /etc/resolv.conf).
  3. The internal DNS servers should use the gateway machine in their "forwarders" statement.

It would be better if the world-facing DNS server was not also your gateway as you're risking exposure of your internal DNS data. Why not host your external zone elsewhere, such as at your service provider? If you can move the world-facing DNS server to a different box (or even a different network), the DNS server on the gateway should only listen on port 53 on the internal NIC.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.