DNS Override - Split DNS

drazziweht

I am trying to set up split dns for a setup with 2 domains:

All the local servers are in domain1 but some of these need to access servers in domain2

the dns is set up as cnames

so dns server entries

web01.domain1.com A 200.200.200.1
publicsite.domain2.com CNAME web01.domain1.com

on pfnsense I am using the resolver with overrides to give internal IP addresses for the servers

web01.domain1.com 10.10.10.1

What I want to happen is from an internal server I connect to publicsite.domain1.com and pfnsense
resolver looks up publicsite, gets the CNAME to web01.domain1.com - uses the override and returns 10.10.10.1

This does not happen. From an internal server ping to web01.domain1.com returns 10.10.10.1
but ping publicsite.domain2.com returns 200.200.200.1 the resolver is obviously doing the whole recursive
lookup and not applying the override when it gets to the web01.domain1.com

Is there any way to make it work without having to add the overrides for all the domain2.com addresses (there are lots of them!)

Thanks

johnpoz

if you want to return an IP for a whole domain, like a wildcard entry you can do redirect vs an override.

local-zone: "yourdomain.com" redirect
local-data: "yourdomain.com A 10.10.10.1"

drazziweht

if you want to return an IP for a whole domain, like a wildcard entry you can do redirect vs an override.

local-zone: "yourdomain.com" redirect
local-data: "yourdomain.com A 10.10.10.1"

No unfortunately not a single remapping

The second domain has multiple cnames that need to map to different internal servers

web1.domain2.com cname web1.domain1.com
web2.domain2.com cname web1.domain1.com
web3.domain2.com cname web2.domain1.com
web4.domain2.com cname web2.domain1.com
web5.domain2.com cname web2.domain1.com

…

Trying to avoid having to put in overrides for all of the domain2 web addresses because there are lots and only have to put in
overrides for the domain1 servers where there are only a few.

conceptually it sounds like it should be possible

internal host looks up web5.domain2.com and gets back a cname web2.domain1.com
then looks up web2.domain1.com and hits the override on the firewall and gets the internal IP

so the fix is sort of turning off the fact that the dnsresolver does the double look up of name -> cname -> ip all in one step
and when it does that it bypasses the the override of the cnamed host.

It might not actually be possible, lots of googling and I have not come up with anything that looks close to an answer !!

johnpoz

what your asking unbound for is not the override so yeah how would it know to check for overrides if a cname comes back. You would have to put in the override for what your actually doing the query for.