DNS Override - Split DNS
-
I am trying to set up split dns for a setup with 2 domains:
All the local servers are in domain1 but some of these need to access servers in domain2
the dns is set up as cnames
so dns server entries
web01.domain1.com A 200.200.200.1
publicsite.domain2.com CNAME web01.domain1.comon pfnsense I am using the resolver with overrides to give internal IP addresses for the servers
web01.domain1.com 10.10.10.1
What I want to happen is from an internal server I connect to publicsite.domain1.com and pfnsense
resolver looks up publicsite, gets the CNAME to web01.domain1.com - uses the override and returns 10.10.10.1This does not happen. From an internal server ping to web01.domain1.com returns 10.10.10.1
but ping publicsite.domain2.com returns 200.200.200.1 the resolver is obviously doing the whole recursive
lookup and not applying the override when it gets to the web01.domain1.comIs there any way to make it work without having to add the overrides for all the domain2.com addresses (there are lots of them!)
Thanks
-
if you want to return an IP for a whole domain, like a wildcard entry you can do redirect vs an override.
local-zone: "yourdomain.com" redirect
local-data: "yourdomain.com A 10.10.10.1" -
if you want to return an IP for a whole domain, like a wildcard entry you can do redirect vs an override.
local-zone: "yourdomain.com" redirect
local-data: "yourdomain.com A 10.10.10.1"No unfortunately not a single remapping
The second domain has multiple cnames that need to map to different internal servers
web1.domain2.com cname web1.domain1.com
web2.domain2.com cname web1.domain1.com
web3.domain2.com cname web2.domain1.com
web4.domain2.com cname web2.domain1.com
web5.domain2.com cname web2.domain1.com…
Trying to avoid having to put in overrides for all of the domain2 web addresses because there are lots and only have to put in
overrides for the domain1 servers where there are only a few.conceptually it sounds like it should be possible
internal host looks up web5.domain2.com and gets back a cname web2.domain1.com
then looks up web2.domain1.com and hits the override on the firewall and gets the internal IPso the fix is sort of turning off the fact that the dnsresolver does the double look up of name -> cname -> ip all in one step
and when it does that it bypasses the the override of the cnamed host.It might not actually be possible, lots of googling and I have not come up with anything that looks close to an answer !!
-
what your asking unbound for is not the override so yeah how would it know to check for overrides if a cname comes back. You would have to put in the override for what your actually doing the query for.