This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNS issue with internal and external domain

Currently, I use the Sophos UTM as my DNS server. I host a few websites (web server is internal) which are accessible from the Internet and I have DNAT's so internal users can access the sites as well. I have encountered an issue and I don't know how to resolve.

I have the following host definition (mysite.com is being used as a substitution for the real FQDN):

and the following DNAT:

...
Rule type: DNAT
Traffic from: ANY
Using service: 80, 443
Going to: External WAN (public IP address of FQDN)
Change destination to: mysite.com host (pictured in the image above)
...

With this setup, everything works fine. Local users and external users can access the domains listed in the network definition above.

The issue I have encountered is that I have another subdomain (info.mysite.com) that I cannot access from the internal network unless I remove the DNS host name "mysite.com" from the network definition that is pictured above. Of course if I do that, internal users can no longer access 'mysite.com'.

I cannot set a static record for 'info.mysite.com' in Sophos because it is hosted externally and it has a dynamic public IP address.

Why does having "mysite.com" defined in the network definition cause 'info.mysite.com' to be unresolvable for internal users?

When using nslookup on an internal PC, I get the following: Unknown can't find info.mysite.com: Non-existent domain. If I change the PC's DNS server from Sophos to a public one (e.g., 8.8.8.8), 'info.mysite.com' is accessible from that PC. I also flush the resolver cache on both the Sophos unit and the PC every time I make a change.

This thread was automatically locked due to age.

Parents

0 adhodgson over 9 years ago

Hi,

Yes that is correct. I have domain.com in the DNS search list on the DHCP server, and have also filled in the host definitions with the FQDN (i.e, intranet.domain.com, etc).

When I first did this I was investigating the Bind zone files that it was creating and this is why I could see what was going on in the backend. Everything is done in separate zone files, so there isn't a zone for domain.com with the relevant records in it. Using this method it is possible to create host definitions for your main domain, and then external hosts on your domain are routed through to the external DNS server.

This is why I wanted you to run some nslookup commands, so we could see what was going on and which servers were responding.

Thanks.
Andrew.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jeff x over 9 years ago in reply to adhodgson
Note: Actual domain name substituted with 'domain.com'

Andrew, the UTM is my DHCP and DNS server. How do I add 'domain.com' in the DNS search list on the DHCP server? Is it even necessary?

When I view the bind zone files (/var/sec/chroot-bind/zones/static) on the UTM, there is one for 'domain.com' and it contains it's local IP address which is specified in the host definition.

Below are the results of the nslookup commands you requested. I undid the changes I made in post #17 before doing nslookup.

D:\Users\Jeff\Desktop>nslookup
Default Server: Unknown
Address: 192.168.0.1
> info.domain.com
Server: Unknown
Address: 192.168.0.1
****** Unknown can't find info.domain.com: Non-existent domain
> info.domain.com.
Server: Unknown
Address: 192.168.0.1
****** Unknown can't find info.domain.com.: Non-existent domain
> set type=soa
> domain.com
Server: Unknown
Address: 192.168.0.1

domain.com
primary    name server = domain.com
responsible mail addr = do—not-reply.fw—notify.net
serial    = 1444215817
refresh = 10800 (3 hours)
retry    = 900 (15 mins)
expire    = 604800 (7 days)
default    TTL = 60 (1 min)
domain.com     nameserver = domain.com
domain.com    internet address = 192.168.1.100
--------------------------------------------------------------------
Sophos UTM 9.714-4 - Home User
Currently testing VM on i3-9100 @ 3.60 GHz
16 GB RAM
Dell Optiplex XE
Intel Core 2 Duo CPU E8600 @ 3.33GHz
8GB RAM
--------------------------------------------------------------------
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Jeff x over 9 years ago in reply to adhodgson
Note: Actual domain name substituted with 'domain.com'

Andrew, the UTM is my DHCP and DNS server. How do I add 'domain.com' in the DNS search list on the DHCP server? Is it even necessary?

When I view the bind zone files (/var/sec/chroot-bind/zones/static) on the UTM, there is one for 'domain.com' and it contains it's local IP address which is specified in the host definition.

Below are the results of the nslookup commands you requested. I undid the changes I made in post #17 before doing nslookup.

D:\Users\Jeff\Desktop>nslookup
Default Server: Unknown
Address: 192.168.0.1
> info.domain.com
Server: Unknown
Address: 192.168.0.1
****** Unknown can't find info.domain.com: Non-existent domain
> info.domain.com.
Server: Unknown
Address: 192.168.0.1
****** Unknown can't find info.domain.com.: Non-existent domain
> set type=soa
> domain.com
Server: Unknown
Address: 192.168.0.1

domain.com
primary    name server = domain.com
responsible mail addr = do—not-reply.fw—notify.net
serial    = 1444215817
refresh = 10800 (3 hours)
retry    = 900 (15 mins)
expire    = 604800 (7 days)
default    TTL = 60 (1 min)
domain.com     nameserver = domain.com
domain.com    internet address = 192.168.1.100
--------------------------------------------------------------------
Sophos UTM 9.714-4 - Home User
Currently testing VM on i3-9100 @ 3.60 GHz
16 GB RAM
Dell Optiplex XE
Intel Core 2 Duo CPU E8600 @ 3.33GHz
8GB RAM
--------------------------------------------------------------------
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data