DNS server split principle
DNS split is required when you need to provide some resources both internal (intranet) and external (internet) using the same name.
Contents
Simple DNS zone
Let's start with a simple reminder.
A standard DNS zone is only internal = no one access any internal resources from the outside. If you want to do so, you have to use a VPN connection.
The Internet connection is just OUT.
Limitations of simple DNS zone
Sometimes you can use the same name on 2 different locations. Therefore, some resources are only accessible when you are inside or outside.
In that example the web server "www" is not reachable from the private zone because the authoritative DNS for the domain doesn't know it!
- The desktop is only using the DNS in the private area (blue zone)
- The DNS server in that area doesn't know any "www" server... So the request will be rejected.
Another problem might occurred when you want to make an internal resource available from both the inside AND the outside.
Problem description
From the outside:
- Smartcards.vehco.com == web-server ... Thanks to the port forwarding TCP 80.
From the inside:
- Smartcards.vehco.com == domain root !! By default the domain root = DNS server @, not www
As you can see, from the inside you cannot reach "smartcards.vehco.com" website! You need to use "http://www.smartcards.vehco.com" or "http://www"
Example
Think of a mobile user...
- When using WIFI he'll be in the blue area ; when using 4G he'll be in the Internet.
- But he only has 1 bookmark to reach the website! And that's smartcards.vehco.com
Solutions
That issue is very simple to fix: you just need to add a new entry (type A or AAA) for the remote server into the private's zone DNS.
Now, "www" will be redirect to the remote IP @.
That is a tricky issue!
To resolve that situation you must use a "DNS split" = "Split horizon" = "brain split".
Solution principle
Depending on where the request comes from (using source IP @ filter) the DNS will use the "internal" or "external" zone description.
- Local network + VPN network + loopback => INTERNAL zone
- Everything else => EXTERNAL zone
>> To access "smartcards.vehco.com" from the INTERNAL zone, you must create a link (CNAME) that point to the web server.
Technical note: the link is using the FQDN "smartcards.vehco.com" while the domain is using the "@" notation.
>> The EXTERNAL zone has only access to a limited set of resources.
References
- Nice description of the problem from a technical point of view: http://www.isaserver.org/articles-tutorials/installation-planning/You_Need_to_Create_a_Split_DNS.html
- YouTube full explanation: https://www.youtube.com/watch?v=55YONDU22qc
- Nice YouTube video (a bit technical): https://www.youtube.com/watch?v=yPH02ZcfFtc
