Public DNS for specific IP address

gusto

@viragomann
Do I understand this correctly ?
If I have pfsense in the office, will I set up the host override just like in the center?
However, do I need to change the IP address to 12.34.56.78?

If I want to use only one PC somewhere on the Internet, then I set in /etc/hosts

12.34.56.78    example1.gg
12.34.56.78    example2.gg
12.34.56.78    example3.gg

viragomann

@gusto
Yes, you can set up the host overrides in the office as well, but you have to point them to the public IP and you must forward incoming http(s) traffic on WAN to the web server.

The hosts file does the same thing as host overrides. If the PC wants to resolve a host name it looks in the hosts file at first. If it finds e.g. example2.gg there it takes the associated IP, if it doesn't find the host it requests the DNS server.

gusto

@viragomann
Thank you for your answer

Is it possible to achieve this goal as well?

I Create in the center a rule to open port 53. In the office, I will set up a DHCP server to assign DNS clients 12.34.56.78
It will work ?

viragomann

@gusto
This would only work in conjunction with VPN, because the center DNS hands out private IPs for the host names, but you need the public on office devices.

gusto

@viragomann
off topic
If I want to create a public DNS resolver, I have to use another type, e.g. bind?
Of course, the resolver would not be designed for the whole world, but for specific ip addresses.

viragomann

@gusto said in Public DNS for specific IP address:

If I want to create a public DNS resolver, I have to use another type, e.g. bind?

For public resolving, yeah, the DNS resolver is meant for internal purposes.

Of course, the resolver would not be designed for the whole world, but for specific ip addresses.

Since you office is behind an ISPs CGN, I guess, you won't have a static IP there.

And as already mentioned, the PCs in the center should get the internal IP for the host names, while all outside devices should get the public IP. So both cannot be done with the same DNS.

gusto

@viragomann
I also created a VPN server, but the client only reaches the IP address of the web server 192.168.1.101 (not a domain name such as example1.gg).
DNS resolver does not work for VPN clients.

viragomann

@gusto
Did you add the DNS server to the VPN configuration to push it to the clients?

Also you have to configure the DNS resolver properly. Ensure that the VPN interface is selected at listening interfaces.
If still no joy add the clients tunnel network to the resolver ACLs.

gusto

@viragomann
Here is my setup

viragomann

@gusto
Since you have enabled DoT, did you care that the clients trust the servers certificate?

What exactly happens on the client, when you try to access a remote host by its name?
Also tried nslookup or something similar?

gusto

@viragomann
BTW what is DoT?

I connected to OpenVPN via an anroid client.
Vivaldi browser writes that the site cannot be connected.
nslookup doesn't work for me on a mobile phone.

viragomann

@gusto said in Public DNS for specific IP address:

BTW what is DoT?

DNS over TLS. Your resolver is set to use TLS.

Vivaldi browser writes that the site cannot be connected.

If the browser does DNS over HTTP (DoH) you are also lost, it won't request your DNS server.
Therefor I asked for another way to check DNS resolution on the client device.

gusto

@viragomann
Thank you very much
I canceled this option and now it works.
I hope this does not endanger safety.
Enable SSL / TLS Service appears to have been enabled by default

johnpoz

@gusto said in Public DNS for specific IP address:

Enable SSL / TLS Service appears to have been enabled by default

No that is not default. It would have to be checked.

viragomann

@gusto said in Public DNS for specific IP address:

I hope this does not endanger safety.

As long as you allow access to the DNS Resolver only from internal devices, there shouldn't be any concerns.

gusto

@viragomann said in Public DNS for specific IP address:

@gusto said in Public DNS for specific IP address:

If I want to create a public DNS resolver, I have to use another type, e.g. bind?

For public resolving, yeah, the DNS resolver is meant for internal purposes.

Of course, the resolver would not be designed for the whole world, but for specific ip addresses.

Since you office is behind an ISPs CGN, I guess, you won't have a static IP there.

And as already mentioned, the PCs in the center should get the internal IP for the host names, while all outside devices should get the public IP. So both cannot be done with the same DNS.

Here you wrote that dns resolver is for internal use only.

viragomann

@gusto
Yeah, it is meant for internal use, but not really limited to it.

But it's also imaginable that someone who has a large network with untrustworthy users inside wants to enable TLS for the sake of security and privacy.

gusto

@viragomann
I understand.
I only have a small LAN. I don't have an office and center. In the first post, I gave just an example for understanding.

gusto

@gusto said in Public DNS for specific IP address:

@viragomann
Thank you very much
I canceled this option and now it works.
I hope this does not endanger safety.
Enable SSL / TLS Service appears to have been enabled by default

What is written here does not apply!
I have 2 applications installed on my smartphone to use openvpn.
OpenVPN free client (old)
OpenVPN Clinet (new)
Regardless of whether "Enable SSL / TLS Service" is enabled, it does not work for OpenVPN free client (old).
Regardless of whether "Enable SSL / TLS Service" is enabled, it does work for OpenVPN client (new).

viragomann

@gusto
There are some dependencies on this:

Does the client device use DoT?
If it doesn't and your Server also is listening on port 53 (non-DoT), it will work anyway.
If the client supports DoT he will use it, even if non-DoT is available. So he has to trust the servers SSL certificat as mentioned. Otherwise the request will fail.

Does VPN client change DNS settings on the device at all?
If he doesn't it won't work anyway.