Difference between revisions of "DNS server split principle"
| Line 18: | Line 18: | ||
| − | =Limitations= | + | =Limitations of simple DNS zone= |
==Shared name== | ==Shared name== | ||
| Line 25: | Line 25: | ||
| − | [[File:DNS 01 shared name issue.png| | + | [[File:DNS 01 shared name issue.png|1024px|caption|DNS 01 shared name issue]] |
In that example the web server "''www''" is not reachable from the private zone because the authoritative DNS for the domain doesn't know it! | In that example the web server "''www''" is not reachable from the private zone because the authoritative DNS for the domain doesn't know it! | ||
| Line 40: | Line 40: | ||
[[File:DNS 02 split horizon issue.png|none|DNS 02 split horizon issue]] | [[File:DNS 02 split horizon issue.png|none|DNS 02 split horizon issue]] | ||
| + | |||
| + | |||
| + | '''Problem description''' | ||
From the outside: | From the outside: | ||
| Line 50: | Line 53: | ||
As you can see, from the inside you cannot reach "smartcards.vehco.com" website! You need to use "http://www.smartcards.vehco.com" or "http://www" | As you can see, from the inside you cannot reach "smartcards.vehco.com" website! You need to use "http://www.smartcards.vehco.com" or "http://www" | ||
| + | |||
| + | |||
| + | '''Notes''' | ||
| + | |||
| + | Think of a mobile user... | ||
| + | * When using WIFI he'll be in the blue area ; when using 4G he'll be in the Internet. | ||
| + | * But he only has 1 bookmark to reach the website! And that's ''smartcards.vehco.com'' | ||
| + | |||
| + | |||
| + | |||
| + | =Solutions= | ||
| + | |||
| + | ==Shared name fix== | ||
| + | |||
| + | That issue is very simple to fix: you just need to add a new entry for the remote server into the private's zone DNS. | ||
| + | |||
| + | |||
| + | [[File:DNS 03 shared name fix.png|1024px|caption|DNS 03 shared name fix]] | ||
| + | ==Share resource fix== | ||
| + | That is a tricky issue! | ||
| + | To resolve that situation you must use a "'''DNS split'''" = "'''Split horizon'''" = "'''brain split'''". | ||
| + | [[File:DNS 04 split horizon fix.png|1024px|caption|DNS 04 split horizon fix]] | ||
DNS split is required when the internal domain name matches an external name. | DNS split is required when the internal domain name matches an external name. | ||
Revision as of 12:21, 22 August 2014
DNS split is required when you need to provide some resources both internal (intranet) and external (internet) using the same name.
Contents
Simple DNS zone
Let's start with a simple reminder.
A standard DNS zone is only internal = no one access any internal resources from the outside. If you want to do so, you have to use a VPN connection.
The Internet connection is just OUT.
Limitations of simple DNS zone
Sometimes you can use the same name on 2 different locations. Therefore, some resources are only accessible when you are inside or outside.
In that example the web server "www" is not reachable from the private zone because the authoritative DNS for the domain doesn't know it!
- The desktop is only using the DNS in the private area (blue zone)
- The DNS server in that area doesn't know any "www" server... So the request will be rejected.
Another problem might occurred when you want to make an internal resource available from both the inside AND the outside.
Problem description
From the outside:
- Smartcards.vehco.com == web-server ... Thanks to the port forwarding TCP 80.
From the inside:
- Smartcards.vehco.com == domain root !! By default the domain root = DNS server @, not www
As you can see, from the inside you cannot reach "smartcards.vehco.com" website! You need to use "http://www.smartcards.vehco.com" or "http://www"
Notes
Think of a mobile user...
- When using WIFI he'll be in the blue area ; when using 4G he'll be in the Internet.
- But he only has 1 bookmark to reach the website! And that's smartcards.vehco.com
Solutions
That issue is very simple to fix: you just need to add a new entry for the remote server into the private's zone DNS.
That is a tricky issue!
To resolve that situation you must use a "DNS split" = "Split horizon" = "brain split".
DNS split is required when the internal domain name matches an external name.
