Best Practise: DNS and VPN (with private network IPs)
Posted
by
ribx
on Server Fault
See other posts from Server Fault
or by ribx
Published on 2014-08-22T00:31:20Z
Indexed on
2014/08/22
4:22 UTC
Read the original article
Hit count: 564
I am trying to find the best solution for my DNS problem. We are running several services in our company that you can reach only over VPN. Other services, that are reachable through the internet got the domain ... At the moment all services inside the VPN network go by .local... These have an VPN IP of the private network 192.168.252.0/24. Clients reach from Linux over OSX to Windows.
I can think of 4 possibilities to implement a DNS infrastructure:
Most common: an internal DNS Server, that is pushed by the VPN. But this has several drawbacks: your DNS responses are limited to the speed of the VPN Connection and your own DNS server. Because of very complex websites, this can increase the time for a page to load quite a lot. Also: we have several VPNs that are not connected to each other and all of them have their own DNS server.
Several DNS servers locally. These have to be configured by hand. And you have to use some third party tool like
dnsmasq. If you start a DNS request, you ask your locally running DNS server, which decides which server to ask for which domain name. One college of mine uses such a solution with this OSX (I am sorry, I don't remember the name of the application).You use your domain hoster. Most of them have APIs available to manipulate your DNS entries. So you could pull your private network informations to your domain hoster. I am not sure whether they all accept private network IPs. But I guess there will be some problems in the same way as in number 4.
The one we currently use, because it's for us the most logical choice: we forward the sub domain *.local.. to our own public DNS Server. This works quite good for some public DNS Servers like Google. But most ISPs do not forward the answers. Or don't do that always. Like my ISP sends me a positive result of the a DNS request of a *.local.. domain only every 10th time I make a
nslookup. (Can someone explain this?)
Here the real Question:
Is there another solution we were not thinking about?
Or:
What of these methods do you use?
© Server Fault or respective owner
