How can I avoid needing a split brain DNS setup with the setup outlined below?


I have what "should" be a pretty basic setup using a Fortigate 200D.

  1. 'Third leg' setup using a DMZ
  2. Explicitly defined web proxy for internal users
  3. Default gateway may be set to this device.
  4. External DNS for our public facing websites.

Every time I look for or ask about this setup I get a pointed towards this documentation, which inherently implies split brain DNS via different IP addresses for access from internal resources. I'm trying really hard to avoid going back that route.

I'm getting the following response, which makes me think that the traffic wasn't being routed correctly.

403 Forbidden: incorrect proxy service was requested

The logs haven't shown any insight so far. I have also tried a packet capture (both on a shared web server and the Fortigate). They both indicate that the packets are dying within the Fortigate.


If you are wanting to avoid split brain DNS then external users would go to www.timistheman.com pointed at the external IP that's VIP/NAT'd down and internal would go to www.mdmarra.local pointed at the internal IP that is routed into the DMZ from the LAN.

If you are wanting internal and external users to resolve to the same FQDN then either split DNS to different IPs or route internal users out and back in (router on a stick).

  • +1 for subtle trolling of MDMarra – phoebus Sep 4 '14 at 4:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.