1

I run a Sonicwall TZ205, and I have different LAN segments setup using ports. I then run multiple VMware servers connected to these ports, and multiple VM guests connected to each vSwitch. I have some firewall rules in between the subnets that allow for some traffic, mainly DNS.

I have all of my web servers pointed to my Windows AD DNS server. The reason I did this originally was to allow my mailserver to communicate with my VM... so when a website I host sends me an email, it does not go out and loopback, it just comes straight through.

I have been troubleshooting DNS issues with one of my servers, and running WireShark I am seeing a lot of DNS coming from my webservers. The Issue I am seeing is actually with a monitoring agent from PRTG, which shows that my DNS fails to resolve queries once every few seconds. All of my other testing shows that DNS is working correctly, as far as I can tell.

I was thinking about changing the DNS servers on my webservers to point out to the internet only. I would setup hairpinning to allow the servers to send me email by going out and coming back in.

Is there any advantage to any of this? Am I making it more complex than it needs to be? Is internal DNS better? I have 2 DNS servers on my primary LAN and thats about all they do.

Thanks in advance!

TLDR; Should my NAT'd privately addressed webservers use public DNS or internal DNS?

Improve this question

1 Answer 1

Reset to default
0

This depends on the amount and distribution of dns queries your webservers are generating. If you're querying the same records quite often you may consider setting up a local caching dns server (bind) to have better control of the dns resolution (maybe conditional forwarding). Having many requests on the same addresses over and over again, your application may benefit from the locality and reduced response time of the dns cache.

I cannot imagine that you're overloading your internal DNS servers - this would require really high workload (i mean several hundreds/thousands of requests per second). Offloading this to public dns services will just increase latency, connection count on your firewall and propably not provide any benefit.

Improve this answer
2
  • Thanks! I am certainly not hitting that many requests. I have thought about setting up BIND, but I think that it might be super complex to admin alongside my windows DNS servers, multiple LAN-DMZs, with local resolution needs. I would have to maintain my website zones on both the windows and linux side in duplicate. Or... I could use conditional forwarders on Windows to forward all my webserver domains to the bind DNS server?
    – ChristopherDill
    Mar 4, 2016 at 5:28
  • Maybe you might know what this would be then: prntscr.com/aayx8v ? When I run a nslookup once every 2 seconds, half of them fail. No other problems that I can see besides this. Other servers do not have this issue. I have troubelshot this endlessly for days, and I am pretty handy around a Windows network.
    – ChristopherDill
    Mar 4, 2016 at 5:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .