How to set up a stealth DNS Server using Mac OS X Server Leopard?

Question

Level 1

8 points

How to set up a stealth DNS Server using Mac OS X Server Leopard?

Hello,

I took over IT administration for a small company four month ago. We run two XServes under Leopard (current version: 10.5.5) in the house. Domain and Website are hosted separately outside at two other companies and I have full access to all configurations for our domains.

I found DNS service to be configured with duplicate SOA and internal users not to be able to reach our own website using the plain domain name. I decided to change this.

I was not able to reach my goal using the options given in Server Admin. It seems to me that I should be able to define an A record on domain level rather than on hostname level. This not being possible results in wildcard resolution such as typo.ourdomain.com pointing to our webserver not being available from internal network. I guess that Apple is doing wrong here.
I have not digged into the bind configuration underneath, because this is a live setup and I have only short times where I can try out things to avoid service disruption, especially when it comes to DNS with its long caching times.

The intended result is described here: <http://www.zytrax.com/books/dns/ch4/index.html#stealth>. They call it a stealth or a DMZ or a split configuration. I dont know the canonical name for this but I guess that split configurations describes it best.

I have found threads with very similar questions in this discussion group, especially this one: <http://discussions.apple.com/thread.jspa?messageID=8028381>, but I was not able to derive a solution from this. Also I felt it to be to complicated to describe my issue as a modification of the question discussed there.

Here are all the details:

I have set up my public DNS as SOA with an A record pointing to our website which has an IP address of its own. The only other entry apart from that is our MX record which points to a host name in our second domain which is mapped (in forward and reverse direction) to our second fixed IP address. Mailservice works as intended (well, there are problems, but they are not related). The setup of the public DNS is complete as of my perspective.

We have a DSL router and a line with a fixed IP address. The router does DHCP for the whole internal network including clients to be reached through our central switch directly and clients connected over two Airport Base stations. Our servers have fixed IP addresses from the same private subnet. The router does NAT. The fixed public IP address is not mapped as of now because I dont provide any service required outside on our primary server.

Currently I run DNS service on our primary server as a caching or forwarding server and I point all our clients to this server using DHCP on the router. To be honest I havent understood completely the difference between forwarding and caching, but I guess, this does not make a difference here. After all, I have no zone entries on this server. Well, that is not true either, the zone entries for the mail server as mentioned above are there.

Our primary server is reachable by its IP address and its .local name only as of now. I have got the idea that it should have a FQDN including reverse resolution, visible only internally. I want to have this running before moving the Open Directory service from our secondary (old) server to the primary server.

Ideally, inhouse DNS on the primary server should resolve absolutely the same way as our public DNS except for the single host name defined there. For all other domains it should cache answers.
This is, all requests for ourdomain.com and www.ourdomain.com and typo.ourdomain.com should resolve to the IP address of our webhosting provider, the MX entry should point to our mailserver and only primaryserver.ourdomain.com should resolve to the static private IP address of our primary server.
Obviously, primaryserver.ourdomain.com resolves to our webhosters IP address from outside much the same way as typo.ourdomain.com; this is intended behaviour. Additionally, our primary server should be selfconscious, id est, it should report its proper hostname primaryserver.ourdomain.com in terminal and elsewhere.

I strongly believe, that my setup is downright archetypal and should be included as a sample setup in the documentation. I have worked my way through it once but could not find it described there. Maybe I will try again, but for the time being, I would be very happy for any advice I could get here.

Bye, Christian

Mac mini G4, Mac OS X (10.5.5)

Posted on Oct 28, 2008 7:26 AM

Reply

Answer 1

Camelot

Level 9

58,575 points

Oct 31, 2008 2:00 PM in response to cvoelker

The short answer is that you cannot configure split DNS using Server Admin.

BIND, the underlying DNS server, does support split DNS and can do what you want, but the Server Admin GUI doesn't have sufficient options to control it. Therefore if you want to implement split DNS you need to get under the hood and edit the BIND configuration file directly.

Of course, if you do that, you can no longer use Server Admin to manage your DNS.

Ideally, inhouse DNS on the primary server should resolve absolutely the same way as our public DNS except for the single host name defined there. For all other domains it should cache answers.

Not going to happen. It doesn't work that way.

Once you tell the server it's authoritative for a domain (e.g. yourdomain.com) then it will believe itself absolutely. It isn't going to use its own zone file for known hosts and send unknown host lookups to another server (or even query some other server for the zone data). This server believes it knows everything about the zone so in this case you'll be able to lookup the single hostname and nothing else.
The only solutions to this is to either put ALL domain records (including the ones that are identical to your public records) into the internal zone file, or use a subdomain (e.g. internal.domain.com).

This is, all requests for ourdomain.com and www.ourdomain.com and typo.ourdomain.com should resolve to the IP address of our webhosting provider

Again, Server Admin doesn't support the use of wildcard record (they're generally discouraged). You can do it if you edit the zone files directly, but not through the GUI.

Reply

Answer 2

cvoelker Author

Level 1

8 points

Oct 31, 2008 3:01 PM in response to Camelot

Thanks for confirming that this split configuration cannot be done with Server admin. Reading Network ServicesAdmin PDF, I already got this impression meanwhile but I was not sure until now.

And yes, you are right, the zone itself has to be duplicated and cannot be split. I did not want to reiterate every detail I had written before because one has to be such precise with these things. I thought describing the internal server as BEHAVING the same as the public server made this clear. Thanks for pointing it out. However, as far as I have learned now, it should be possible to be SOA for one zone and caching server for everything else.

I refrain from configuring bind manually on a Mac OS machine because this makes things very intransparent. I am eager to set up everything in a way that documents itself. That way, I wont have to put up a caution mark in every place so that I dont stumble upon my own feet the next time I pass by.

I will have to check whether I can set up the service on my router the way I want it to work or go with the Apple way of doing things. You say that wildcard resolution is discouraged. I see that commonly being done everywhere. I guess, I have to go for the book of Cricket Liu although my bookseller told me that he had not sold a single copy of it since three years and that nobody needs that it seems to him that nobody cares for this kind of information any more. Am I late ;-)?

Bye, Christian

Reply

Answer 3

MrHoffman

Level 10

146,479 points

Oct 31, 2008 4:08 PM in response to cvoelker

The Apple way is to have a simple UI, and to lift the hood and access and use the power of Unix when you need it. Here, you need it.

Acquire the current edition of the Liu book (the 5th edition is what I'm using) and spend a few cash units to get yourself a copy of the CutEdge DNS Enabler tool.

The Liu book covers split-zone DNS.

Reply

Answer 4

foilpan

Level 4

1,385 points

Nov 1, 2008 9:04 AM in response to cvoelker

what i usually do is configure the server as caching dns with soa for the zone, add A records or CNAMES for the public and private hosts, and that all generally works.

now, i'm no dns expert, and that approach may not be the best way to do it, but it works without editing bind config files manually. of course, you can still do that, too. it's easy enough.

in some cases where extensive dns changes aren't necessary, i've used the "dns forwarder" function of dnsmasq at the firewall/router to selectively route requests for whole domains or specific hosts to local addresses from within the lan. this works nicely.

Reply

Answer 5

cvoelker Author

Level 1

8 points

Nov 1, 2008 1:46 PM in response to foilpan

Yes this is the "Apple way" solution I ponder about. This will do most of what I want apart from the wildcard behaviour. Thanks for telling, that it is acutally done this way somewhere else too.

As I said, I havent understood the use of forwarding so far. Maybe the solution to my question would have been one more example in the documentation provided by Apple. Ah, and by the way, I would love to be still able to get documentation printed and bound separately. So much better to handle than the pile of paper I am shuffling around all the time. And yes I know, paper ages fast, but then, it is just so much easier to study a book instead of reading everything onscreen.

Bye, Christian

Reply

Answer 6

Camelot

Level 9

58,575 points

Nov 1, 2008 11:27 PM in response to cvoelker

I havent understood the use of forwarding so far

First understand you don't need to use forwarders at all.

There are three things a server can do when it gets a request for a zone it is not authoritative for:

1) reject the request (return 'unknown host')
2) forward the request to another DNS server
3) resolve the hostname by querying the root servers and return the result

Option 1 is typically used in authoritative servers that you don't want to handle requests for other domains.
Option 2 offloads the request to some other server
Option 3 puts more load on the DNS server, but it will cache results to improve performance for subsequent lookups on the same hostname.

If you enable forwarders (by specifying one or more forwarder addresses in System Admin) then you fall into category 2. If you have no forwarders set you fall into category 3 - the server will query the root servers and follow the chain to resolve the request.
You have to go out of your way to get option 1.

So the upshot is that whether or not you use forwarders your users will get the same experience - it's just a different way to get there.

Reply

Answer 7

cvoelker Author

Level 1

8 points

Nov 2, 2008 1:25 AM in response to Camelot

Hello,

now it makes sense to me if I read it that way:

Forwarding is the kind way of saying no for master and slave name servers which would otherwise choose to reject requests for zones not hosted by themselves.

Forwarding is not an alternative way of setting up a proxy name server put in place to speed up name resolution for my internal clients. And this is the main task of my private name server besides hosting the single domain I am responsible for.

Online resources I have found always describe how forwarding works and put that description right beside the description of caching name servers, thus implying that it might be used interchangeably. Thanks for pointing out the difference in application of the two methods and resolving my confusion.

Bye, Christian

Reply

Answer 8

cvoelker Author

Level 1

8 points

Nov 2, 2008 1:34 AM in response to Camelot

Ah, and I see, forwarding could also be used to avoid the delay for my clients when doing changes on my master name server. This would be an alternative to setting up a slave name server in cases where you cant get the permission for zone transfers without much hassle.

Neither a slave nor a forwarder for my domain would be useful in my case because of my requirement of adding more names on my LAN.

Reply