Solved

internal and external DNS

Posted on 2002-05-02
12
350 Views
Last Modified: 2010-03-18
i am using red hat ipchains to set up a firewall. Since the internal machines need to use internal internet service, i have set up a internal DNS
for local network and a external DNS for outside network. Both are using linux red hat. It works
fine. Both outside and inside machines can access my internal internet service using domain name.

But if a new internet service machine is added outside the firewall, i need to configure both external and internal DNS since if I don't add
it to the internal DNS, the machines inside the firewall can't query the IP of the new machine.
I feel very troublesome every time the IP is changed or a new machine is added outside firewall. I need to change both DNS.

Is there anyway that if a domain name can't be queried by the internal DNS, the request can be forwarded to external DNS automatically? If so, i can just change the external DNS. Also, internal machines can access the both internet service inside and outside the firewall without changing the config of internal DNS

or any other suggestions?


0
Comment
Question by:Torus
  • 3
  • 3
  • 2
  • +3
12 Comments
 
LVL 40

Expert Comment

by:jlevie
Comment Utility
Not if you use the same domain name inside and outside of the firewall. Each of the DNS servers believe that they are authoritative for the domain and thus won't forward a request for that domain elsewhere. In a like manner there isn't a client side solution either. A client could have both DNS servers configured, but the first server that it uses has to have data for the inside and outside hosts. If there's no A, CNAME, or PTR record the DNS server will return a 'no data error' and the client won't ask the other server. The only time a second DNS server would be used would be when the first server can't be contacted.
0
 
LVL 5

Expert Comment

by:BlackDiamond
Comment Utility
When you create a split horizon (same names, different IPs)for internal and external DNS, you will have to manage the entirety of those domains on both DNS servers.  The best way to manage a split horizon to create a subdomain for the machines that will have different ip's (like mycity.mydomain.com).  That way you only have to manage a smaller piece of the domain (just the machines with different ip's) on both DNS servers.  Then let your external DNS servers resolve for the rest.
0
 
LVL 2

Author Comment

by:Torus
Comment Utility
Sorry, I don't quite understand how will work.
Can you give me an example or more in detail.

Thanks
0
 
LVL 40

Expert Comment

by:jlevie
Comment Utility
That way that works is that you have your outside DNS servers configured to be your domain (mydomain.tld) and all outside servers are configured to be in that domain. The outside servers are configured to delegate authority for a sub-domain (inside.mydom.tld) to your inside DNS servers and of course all machines on the inside of the firewall are configured to be in the sub domain. So when an inside host needs to access an outside server it'll ask the inside DNS server, but since those know that they are only authoritative for a sub-domain they'll pass the request up to the outside servers.

Now this works if your Internet accessible servers are all located outside of the firewall. It becomes problematical if your servers are actually inside the firewall with Internet requests being port forwarded or passed through the firewall via static NAT translations. In particular web servers are a problem, especially when using name based virtual hosts. URL's are, of course, hostname sensitive. So if you have aweb server inside of the firewall it effectively has to properly respond to two names, e.g., web.mydomain.tld and web.inside.mydom.tld. SSH servers are also a problem for a similar reason.
0
 
LVL 2

Author Comment

by:Torus
Comment Utility
Well, i think it is not applicable in my situation to set a subdomain internally and domain outside. I think I need
to set to access the services in the same name no matter inside or outside firewall.

0
Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

 
LVL 40

Accepted Solution

by:
jlevie earned 100 total points
Comment Utility
If you can't use a subdomain on the inside then you have to maintain each of the DNS namespaces like you've been doing. Using a subdomain is the only way you can have the inside DNS forward requests for the external machines.
0
 
LVL 2

Author Comment

by:Torus
Comment Utility
ok,anyway.
Thanks
0
 
LVL 1

Expert Comment

by:Moondancer
Comment Utility
ADMINISTRATION WILL BE CONTACTING YOU SHORTLY.  Moderators Computer101, Netminder or Mindphaser will return to finalize these if they are still open in 7 days.  Experts, please post closing recommendations before that time.

Below are your open questions as of today.  Questions which have been inactive for 21 days or longer are considered to be abandoned and for those, your options are:
1. Accept a Comment As Answer (use the button next to the Expert's name).
2. Close the question if the information was not useful to you, but may help others. You must tell the participants why you wish to do this, and allow for Expert response.  This choice will include a refund to you, and will move this question to our PAQ (Previously Asked Question) database.  If you found information outside this question thread, please add it.
3. Ask Community Support to help split points between participating experts, or just comment here with details and we'll respond with the process.
4. Delete the question (if it has no potential value for others).
   --> Post comments for expert of your intention to delete and why
   --> YOU CANNOT DELETE A QUESTION with comments; special handling by a Moderator is required.

For special handling needs, please post a zero point question in the link below and include the URL (question QID/link) that it regards with details.
http://www.experts-exchange.com/jsp/qList.jsp?ta=commspt
 
Please click this link for Help Desk, Guidelines/Member Agreement and the Question/Answer process.  http://www.experts-exchange.com/jsp/cmtyHelpDesk.jsp

Click you Member Profile to view your question history and please keep them updated. If you are a KnowledgePro user, use the Power Search option to find them.  

Questions which are LOCKED with a Proposed Answer but do not help you, should be rejected with comments added.  When you grade the question less than an A, please comment as to why.  This helps all involved, as well as others who may access this item in the future.  PLEASE DO NOT AWARD POINTS TO ME.

To view your open questions, please click the following link(s) and keep them all current with updates.
http://www.experts-exchange.com/questions/Q.20113737.html
http://www.experts-exchange.com/questions/Q.20193168.html
http://www.experts-exchange.com/questions/Q.20005308.html
http://www.experts-exchange.com/questions/Q.20296201.html
http://www.experts-exchange.com/questions/Q.20298574.html
http://www.experts-exchange.com/questions/Q.20300775.html



*****  E X P E R T S    P L E A S E  ******  Leave your closing recommendations.
If you are interested in the cleanup effort, please click this link
http://www.experts-exchange.com/jsp/qManageQuestion.jsp?ta=commspt&qid=20274643
POINTS FOR EXPERTS awaiting comments are listed in the link below
http://www.experts-exchange.com/commspt/Q.20277028.html
 
Moderators will finalize this question if in @7 days Asker has not responded.  This will be moved to the PAQ (Previously Asked Questions) at zero points, deleted or awarded.
 
Thanks everyone.
Moondancer
Moderator @ Experts Exchange
0
 

Expert Comment

by:CleanupPing
Comment Utility
Torus:
This old question needs to be finalized -- accept an answer, split points, or get a refund.  For information on your options, please click here-> http:/help/closing.jsp#1
EXPERTS:
Post your closing recommendations!  No comment means you don't care.
0
 
LVL 5

Expert Comment

by:BlackDiamond
Comment Utility
refund..
0
 
LVL 12

Expert Comment

by:paullamhkg
Comment Utility
No comment has been added lately, so it's time to clean up this TA.
I will leave the following recommendation for this question in the Cleanup topic area:

Accept: jlevie {http:#7005163}

Please leave any comments here within the next seven days.
PLEASE DO NOT ACCEPT THIS COMMENT AS AN ANSWER!

paullamhkg
EE Cleanup Volunteer
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now