DMZ publc DNS

[scmoh]

Hi,

I have 2 networks in internal network and dmz network.

Internal network have 2 DNS servers to resolve name in both internal, dms hosts and public sites, dms network only have a public dns to resolve name in dmz host with public host name with public ip address (no internal ip address).

Recently, application vendor said that one of the application server cannot resolve host name in the dmz (based on internal ip address).

Need your help:
1. can i use the same dmz dns server to resolve dms hosts with internal address?
2. how to setup one internal dmz zone (192.168.x.x) and without forwards to public isp, if can use the same dms dns server.

Please advise.

with regards,
SC Moh

 

[Noway2]

Speaking generically, yes, your DNS server can reside in a DMZ and it can be used to resolve names and addresses for your LAN zone. Your DNS server will need a zone file and be configured to be authoritative for the zones you wish it to resolve for. You can then point your LAN PCs at the server and it should resolve the addresses. The tricky part will be getting the traffic to the server as you will likely require either an NAT rule or a static route to be able to get traffic between your LAN and DMZ. I would also recommend a set of firewall rules to limit the scope of the allowed traffic to queries of the DNS and the related response; in other words traffic should not be allowed to originate from your DNS in the DMZ to your LAN.

application vendor said that one of the application server cannot resolve host name in the dmz (based on internal ip address)

It would be better to address this type of question with actual data, events, and error messages. There are lots of reasons why it "couldn't resolve". For example, did the connection time out, was the query refused, or did it give a 'failure' indicating a problem with the zone configuration? Each of these conditions would result in a failure to resolve but they have different resolutions.

 

[scmoh]

Hi Noway2,

Thank you on your note.

In the DMZ network, can i use one DNS server to resolve all DMZ hosts with public ip address (as the main DNS server and ISP as the secondary DNS server) and with the same DNS server to resolve all DMZ hosts with internal ip address ?

Please advise.

with regards,
SC Moh