To consolidate the hassel, you might want to look into "Views" in Bind 9. I
think Windows 2000 DNS supports Views as well. Essentially, when the DNS
server gets a request for an IP address, it will respond with a different
answer based on the client source IP address criteria. So, when your
private machines query for the web server by DNS name, they get your private
address scheme. When someone on the internet queries your web server by the
same DNS name, they get your public IP address.
It's split-dns without the need for multiple DNS servers and zone files.
If you only have a few machines, you could do hosts files, but I try to
avoid them even for small LANs. All too often those small LANs become much
larger or a third party does work and doesn't watch for custom files like
the HOSTS file.
So, if you did use a Bind View implementation, you would place your DNS
inside your NAT'd address space and provide a translation for the DNS server
through the PIX. That's about it (outside of setting up the Bind View
If you've got your external DNS resources outsourced to another company,
then you'll just need to set up an internal private DNS, create a record for
each split resource with the alternate IP and then make sure your internal
machines go through your internal DNS before they hit your outsourced DNS.
> We have a web server and mail server behind a PIX firewall.
> Using NAT, a connection coming from the internet can connect
> to our web server by using it's IP address. Also LAN clients
> can connect to internet web servers using their IP addresses only.
> What we would like to do is:
> 1. Have internal clients query our web server inside by
> its name such as www.xyz.com.
> 2. Have internal clients query other web servers on the internet
> by it's name (DNS lookup).
> Where should the DNS server be? How should they be configured?
> Any detailed explanation/analysis would be appreciated. I have included
> my email.
> our configuration looks something like this:
> Router= 220.127.116.11 /27
> PIX outside= 18.104.22.168/27
> PIX inside= 22.214.171.124/27
> Web Server= 126.96.36.199/27 (188.8.131.52)
> Mail Server= 184.108.40.206/27 (220.127.116.11)
> Client 1= 18.104.22.168/27
> Client 2= 22.214.171.124/27
> PIX Router INTERNET
> | | __________
> | | outside | |
> | | ____________ | |_____
> __________ |__________|
> | inside
> |hub |
> | | |
> | | |
> ___________ ___________ | |
> | | | | __________ ___________
> |Web | |Mail | | | |
> |Server | |Server | |Client 1 | |Client
> __________ ___________ |__________| |__________|