Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS name alias + different reverse DNS (CNAME) = fail? IP = work?

    Scheduled Pinned Locked Moved Firewalling
    1 Posts 1 Posters 709 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      Nadrek
      last edited by

      Question:
      How can I get aliases of sites like ocsp.startssl.com or ocsp.rapidssl.com to work based on DNS names - both of them lead to Akamai servers per Dig or reverse DNS?

      Situation:
      I'm attempting to lock down a network (VMWare ESXi, separate virtual NIC leading to a separate, isolated vSwitch) for outbound access, and OCSP is a concern.

      Thus, I set up an alias for Certificate Authorities, and then add in a Host entry for
      ocsp.startssl.com

      And put a rule on the local OptN interface the traffic will come from to allow IPv4 TCP port 80 to that alias.

      This fails.

      Putting the hardcoded IP address of the Akamai server does actually work.

      Dig results are:

      ;; QUESTION SECTION:
      ;ocsp.startssl.com. IN A

      ;; ANSWER SECTION:
      ocsp.startssl.com. 5 IN CNAME www.startssl.com.edgesuite.net.
      www.startssl.com.edgesuite.net. 5 IN CNAME a1603.g1.akamai.net.
      a1603.g1.akamai.net. 5 IN A 23.63.227.168
      a1603.g1.akamai.net. 5 IN A 23.63.227.128

      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.