1

We have a windows 2012 domain with 2 different sites connected via vpn.

Site 1 has a dc with dns, Site 2 has two dc with dns

Most dns zones are integrated into AD, so a change is reflected on all 3 dns.

Site 1 and Site 2 have both more subnets (please consider a lan and dmz) while the vpn links only lan to lan. In both dmz there are servers which are accessible from internet so there is no need to add other vpn for every combination of subnets between the sites.

What I would like to achieve is to access a dmz server through its private address if I'm in the same site, through the associated public ip if it is in the other site.

So name resolution should be different based on the site where the client is. May be I can create zones not integrated in AD, so they can be different on each dns.

I assume clients on site1 will ask dns on site1 first, otherwise this configuration will not work.

Site 2 has two dns: do I have to manually align them for non AD integrated zones ? Can I do something magic with primary/secondary/stub zones ?

2
  • If i understand you correctly the feature you are searching is named en.wikipedia.org/wiki/Split-horizon_DNS how to setup this in Windows: no idea – Dennis Nolte Sep 19 '18 at 11:57
  • I assume clients on site1 will ask dns on site1 first - Yes, if you configure the clients that way. Site 2 has two dns: do I have to manually align them for non AD integrated zones ? - Yes. Can I do something magic with primary/secondary/stub zones ? - It's not magic. You just need to set up a Primary and Secondary copy of the zone. – joeqwerty Sep 19 '18 at 12:09
1

You can achieve this with Windows DNS servers once they are upgraded to Server 2016. In that release, you can use DNS Policies to achieve Split-Brain DNS.

Failing that, you might be able to achieve this by removing the A record from the AD-integrated zone, and creating a new Forward Lookup Zone (non-AD-Integrated) on each DC/DNS server, and create a blank A record with the IP address for which you want to have the name resolve for the site that the DC/DNS server primarily serves. This is not foolproof, and would not be reliable.

In the past, I have achieved this by using firewall trickery (my apologies, but its been several years since I performed this) whereby the firewall was configured to route requests directly to the published resource rather than attempting a hairpin on the firewall.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.