Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Generic DNS question

    Scheduled Pinned Locked Moved DHCP and DNS
    4 Posts 3 Posters 1.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mervincm
      last edited by

      This is what I have in place.  Does it make sense, or did I miss something.

      I have a registered domain.ca.  I use domain registrar's DNS as authoritive (I think that's the right term) updated dynamically to be my pfSense WAN interface public IP.  I don't actually have any hosts defined in their DNS, just the root (@)  It's sole purpose is so I can use name to assist in Open_VPN access from external.

      My internal windows domain is based on that, but one level deeper. it's inside.domain.ca.  My Windows DC and another Windows VM are authoritive for that inside.domain.ca, and I have DNS forwarder loaded on pfSense.  I have all three configured to forward to my ISP's DNS servers.  pfSense DNS is only used if my Windows DM's are down for some reason, and so that my pfsense can correctly resolve my inside hosts for reports / graphs etc.  I have manually created host entries for all inside hosts in the pfSense firewall.

      These internal DNS are all just for internal resolution, My internal DNS's and the Registar DNS do not know or forwards to each other.  I have no need to ever resolve hostname.inside.domain.ca from the Internet.

      I considered adding a host entry for inside.domain.ca to my resistrar's DNS and points that to my WAN public IP, but that seemed counter productive since it would be an external IP and as I said before I don't ever need to resolve anything.inside.domain.ca from external, and internally, well you always want the internal private IP!

      I wondered if I could put say the private ip of my DC in my registrars DNS as a host record for inside.domain.ca, but I am not sure how that would help anything, I am not sure if they let you use prive IP this way, and franky I am not sure I want external knowing an important internal IP address from a security perspective!

      Just looking for a sanity check here!

      1 Reply Last reply Reply Quote 0
      • M
        mervincm
        last edited by

        No feedback?  Either I got everything right, or I made such a big mess it's not worth fixing? :)

        1 Reply Last reply Reply Quote 0
        • R
          rcampbell
          last edited by

          There is no need to have 'internal.domain.ca' for your internal domain to differentiate it from the external domain.  Doing that just makes your internal fqdn's unecisarily long.

          What most people do that use split DNS is simply name your internal domain the same as your external domain.  What differentiates between the result is who is the DNS server.

          For example lets say your server is 'server1.domain.ca' and it hosts some website.  Internally your PC's will have their DNS set to an internal DNS server (could be pfSense or a DNS server)  - when they lookup this site - they will get an internal address and browse to the site.  Externally you would enter server1.domain.ca in your external domain but put the WAN IP address of your router.  If an external PC types the same address you get to the correct website as the external user looks up an external DNS but gets routed through.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            For internal domains, use tld that is internal only.. I use local.lan for my local domain if you registered domain.ca - then use domain.lan for local or domain.local or domain.whatever that is not a public tld and tells you its local.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • First post
              Last post
            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.