forked from extern/shorewall_code
207 lines
7.3 KiB
XML
207 lines
7.3 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
|
|
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
|
|
<article>
|
|
<!--$Id$-->
|
|
|
|
<articleinfo>
|
|
<title>Simple way to set up Split DNS</title>
|
|
|
|
<authorgroup>
|
|
<author>
|
|
<firstname>Tom</firstname>
|
|
|
|
<surname>Eastep</surname>
|
|
</author>
|
|
</authorgroup>
|
|
|
|
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
|
|
|
|
<copyright>
|
|
<year>2008</year>
|
|
|
|
<holder>Thomas M. Eastep</holder>
|
|
</copyright>
|
|
|
|
<legalnotice>
|
|
<para>Permission is granted to copy, distribute and/or modify this
|
|
document under the terms of the GNU Free Documentation License, Version
|
|
1.2 or any later version published by the Free Software Foundation; with
|
|
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
|
Texts. A copy of the license is included in the section entitled
|
|
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation
|
|
License</ulink></quote>.</para>
|
|
</legalnotice>
|
|
</articleinfo>
|
|
|
|
<section>
|
|
<title>What is Split DNS</title>
|
|
|
|
<para><firstterm>Split DNS</firstterm> is simply a configuration in which
|
|
the IP address to which a DNS name resolves is dependent on the location
|
|
of the client. It is most often used in a NAT environment to insure that
|
|
local clients resolve the DNS names of local servers to their RFC 1918
|
|
addresses while external clients resolve the same server names to their
|
|
public counterparts.</para>
|
|
</section>
|
|
|
|
<section>
|
|
<title>Why would I want to use Split DNS?</title>
|
|
|
|
<para>See <ulink url="FAQ.htm#faq2">Shorewall FAQ 2</ulink>.</para>
|
|
</section>
|
|
|
|
<section>
|
|
<title>Setting up Split DNS</title>
|
|
|
|
<para>Setting up Split DNS is extremely simple:</para>
|
|
|
|
<orderedlist>
|
|
<listitem>
|
|
<para>Be sure that your firewall/router can resolve external DNS
|
|
names.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Install the <emphasis role="bold">dnsmasq</emphasis> package
|
|
(<ulink
|
|
url="http://www.thekelleys.org.uk/dnsmasq/doc.html">http://www.thekelleys.org.uk/dnsmasq/doc.htm</ulink>l)
|
|
and arrange for it to start at boot time. There are many dnsmasq
|
|
HOWTOs on the Internet.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Add your local hosts to <filename>/etc/hosts</filename> on the
|
|
firewall/router using their local RFC 1918 addresses. Here's an
|
|
example:<programlisting>#
|
|
# hosts This file describes a number of hostname-to-address
|
|
# mappings for the TCP/IP subsystem. It is mostly
|
|
# used at boot time, when no name servers are running.
|
|
# On small systems, this file can be used instead of a
|
|
# "named" name server.
|
|
# Syntax:
|
|
#
|
|
# IP-Address Full-Qualified-Hostname Short-Hostname
|
|
#
|
|
|
|
127.0.0.1 localhost
|
|
|
|
<emphasis role="bold">172.20.0.1 openvpn.shorewall.net openvpn
|
|
172.20.0.2 vpn02.shorewall.net vpn02
|
|
172.20.0.3 vpn03.shorewall.net vpn03
|
|
172.20.0.4 vpn04.shorewall.net vpn04
|
|
172.20.0.5 vpn05.shorewall.net vpn05
|
|
172.20.0.6 vpn06.shorewall.net vpn06
|
|
172.20.0.7 vpn07.shorewall.net vpn07
|
|
172.20.0.8 vpn08.shorewall.net vpn08
|
|
172.20.0.9 vpn09.shorewall.net vpn09
|
|
172.20.0.10 vpn10.shorewall.net vpn10
|
|
172.20.0.11 vpn11.shorewall.net vpn11
|
|
172.20.0.12 vpn12.shorewall.net vpn12
|
|
172.20.0.13 vpn13.shorewall.net vpn13
|
|
172.20.0.14 vpn14.shorewall.net vpn14
|
|
172.20.0.15 vpn15.shorewall.net vpn15
|
|
172.20.0.16 vpn16.shorewall.net vpn16
|
|
|
|
172.20.1.1 linksys.shorewall.net linksys
|
|
172.20.1.100 hp8500.shorewall.net hp8500
|
|
172.20.1.102 ursa.shorewall.net ursa
|
|
172.20.1.105 tarry.shorewall.net tarry
|
|
172.20.1.107 teastep.shorewall.net teastep
|
|
172.20.1.109 hpmini.shorewall.net hpmini
|
|
|
|
172.20.1.130 lanursa.shorewall.net lanursa
|
|
172.20.1.131 wookie.shorewall.net wookie
|
|
172.20.1.132 tipper.shorewall.net tipper
|
|
172.20.1.133 nasty.shorewall.net nasty
|
|
172.20.1.134 ursadog.shorewall.net ursadog
|
|
172.20.1.135 opensuse.shorewall.net opensuse
|
|
172.20.1.136 centos.shorewall.net centos
|
|
172.20.1.137 fedora.shorewall.net fedora
|
|
172.20.1.138 debian.shorewall.net debian
|
|
172.20.1.139 archlinux.shorewall.net archlinux
|
|
172.20.1.140 foobar.shorewall.net foobar
|
|
172.20.1.141 deblap.shorewall.net deblap
|
|
172.20.1.254 firewall.shorewall.net firewall
|
|
|
|
206.124.146.254 blarg.shorewall.net blarg
|
|
</emphasis>
|
|
# special IPv6 addresses
|
|
::1 localhost ipv6-localhost ipv6-loopback
|
|
|
|
fe00::0 ipv6-localnet
|
|
|
|
ff00::0 ipv6-mcastprefix
|
|
ff02::1 ipv6-allnodes
|
|
ff02::2 ipv6-allrouters
|
|
ff02::3 ipv6-allhosts
|
|
|
|
<emphasis role="bold">2002:ce7c:92b4::1 gateway6.shorewall.net gateway6
|
|
2002:ce7c:92b4:1::2 mail6.shorewall.net mail6
|
|
2002:ce7c:92b4:1::2 lists6.shorewall.net lists6
|
|
2002:ce7c:92b4:2::2 server6.shorewall.net server6</emphasis>
|
|
|
|
</programlisting></para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para> If your local hosts are configured using DHCP, that is a simple
|
|
one-line change to the DHCP configuration.</para>
|
|
</listitem>
|
|
</orderedlist>
|
|
|
|
<para><emphasis role="bold">And that's it!</emphasis> Your local clients
|
|
will resolve those names in the firewall/router's
|
|
<filename>/etc/hosts</filename> file as defined in that file. All other
|
|
names will be resolved using the firewall/router's Name Server as defined
|
|
in <filename>/etc/resolv.conf</filename>.</para>
|
|
|
|
<para>Example:</para>
|
|
|
|
<para>From an Internet Host:<programlisting>gateway:~ # host linksys.shorewall.net
|
|
linksys.shorewall.net has address 206.124.146.180
|
|
gateway:~ # </programlisting></para>
|
|
|
|
<para>From Tipper (192.168.1.132):<programlisting>teastep@tipper:~$ host linksys
|
|
linksys.shorewall.net has address 172.20.1.1
|
|
teastep@tipper:~$ </programlisting></para>
|
|
|
|
<para>As a bonus, dnsmasq can also act as a DHCP server. Here are some
|
|
excerpts from the corresponding /etc/dnsmasq.conf:</para>
|
|
|
|
<programlisting>interface=eth1
|
|
|
|
dhcp-range=172.20.1.210,172.20.1.219,24h
|
|
|
|
dhcp-host=00:11:85:89:da:9b,172.20.1.220
|
|
|
|
dhcp-host=00:1A:73:DB:8C:35,172.20.1.102
|
|
dhcp-host=00:25:B3:9F:5B:FD,172.20.1.100
|
|
dhcp-host=00:1F:E1:07:53:CA,172.20.1.105
|
|
dhcp-host=00:1F:29:7B:04:04,172.20.1.107
|
|
dhcp-host=00:24:2b:59:96:e2,172.20.1.109
|
|
|
|
dhcp-host=00:1B:24:CB:2B:CC,172.20.1.130
|
|
dhcp-host=00:21:5a:22:ac:e0,172.20.1.131
|
|
dhcp-host=08:00:27:B1:46:a9,172.20.1.132
|
|
dhcp-host=08:00:27:31:45:83,172.20.1.133
|
|
dhcp-host=08:00:27:28:64:50,172.20.1.134
|
|
dhcp-host=08:00:27:4b:38:88,172.20.1.135
|
|
dhcp-host=08:00:27:f6:4d:65,172.20.1.136
|
|
dhcp-host=08:00:27:dc:cd:94,172.20.1.137
|
|
dhcp-host=08:00:27:0f:d3:8f,172.20.1.138
|
|
dhcp-host=08:00:27:42:9c:01,172.20.1.139
|
|
dhcp-host=08:00:27:5a:6c:d8,172.20.1.140
|
|
dhcp-host=08:00:27:da:96:78,172.20.1.141
|
|
|
|
dhcp-option=19,0 # option ip-forwarding off
|
|
dhcp-option=44,0.0.0.0 # set netbios-over-TCP/IP nameserver(s) aka WINS server(s)
|
|
dhcp-option=45,0.0.0.0 # netbios datagram distribution server
|
|
dhcp-option=46,8 # netbios node type
|
|
dhcp-option=47 # empty netbios scope.
|
|
|
|
dhcp-option=option:domain-search,shorewall.net
|
|
</programlisting>
|
|
</section>
|
|
</article>
|