This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNS issue with internal and external domain

Currently, I use the Sophos UTM as my DNS server. I host a few websites (web server is internal) which are accessible from the Internet and I have DNAT's so internal users can access the sites as well. I have encountered an issue and I don't know how to resolve.

I have the following host definition (mysite.com is being used as a substitution for the real FQDN):

and the following DNAT:

...
Rule type: DNAT
Traffic from: ANY
Using service: 80, 443
Going to: External WAN (public IP address of FQDN)
Change destination to: mysite.com host (pictured in the image above)
...

With this setup, everything works fine. Local users and external users can access the domains listed in the network definition above.

The issue I have encountered is that I have another subdomain (info.mysite.com) that I cannot access from the internal network unless I remove the DNS host name "mysite.com" from the network definition that is pictured above. Of course if I do that, internal users can no longer access 'mysite.com'.

I cannot set a static record for 'info.mysite.com' in Sophos because it is hosted externally and it has a dynamic public IP address.

Why does having "mysite.com" defined in the network definition cause 'info.mysite.com' to be unresolvable for internal users?

When using nslookup on an internal PC, I get the following: Unknown can't find info.mysite.com: Non-existent domain. If I change the PC's DNS server from Sophos to a public one (e.g., 8.8.8.8), 'info.mysite.com' is accessible from that PC. I also flush the resolver cache on both the Sophos unit and the PC every time I make a change.

This thread was automatically locked due to age.

0 Jeff x over 9 years ago in reply to adhodgson

Hi,

I run in this configuration where I have internal hostnames in my domain which point at internal servers using the network host definition, and can access external APIs etc also on my domain that point at Amazon servers which are dynamic. DNS for the domain is handled at Amazon and the UTM consults the DNS at Amazon for the relevant records, this works as designed.

In DHCP are you using a DNS search list, do you have any forwarders or DNS request routing defined?

Thanks.
Andrew.

Does your network host definition contain your base domain name (i.e., yoursite.com) without a subdomain?

I am using the UTM for DHCP and DNS and I do have forwarders but no DNS request routing defined. No DNS search list.

--------------------------------------------------------------------
Sophos UTM 9.714-4 - Home User
Currently testing VM on i3-9100 @ 3.60 GHz
16 GB RAM
Dell Optiplex XE
Intel Core 2 Duo CPU E8600 @ 3.33GHz
8GB RAM
--------------------------------------------------------------------
Cancel
Vote Up 0 Vote Down

Cancel
0 adhodgson over 9 years ago

Hi,

Yes that is correct. I have domain.com in the DNS search list on the DHCP server, and have also filled in the host definitions with the FQDN (i.e, intranet.domain.com, etc).

When I first did this I was investigating the Bind zone files that it was creating and this is why I could see what was going on in the backend. Everything is done in separate zone files, so there isn't a zone for domain.com with the relevant records in it. Using this method it is possible to create host definitions for your main domain, and then external hosts on your domain are routed through to the external DNS server.

This is why I wanted you to run some nslookup commands, so we could see what was going on and which servers were responding.

Thanks.
Andrew.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jeff x over 9 years ago in reply to adhodgson
Note: Actual domain name substituted with 'domain.com'

Andrew, the UTM is my DHCP and DNS server. How do I add 'domain.com' in the DNS search list on the DHCP server? Is it even necessary?

When I view the bind zone files (/var/sec/chroot-bind/zones/static) on the UTM, there is one for 'domain.com' and it contains it's local IP address which is specified in the host definition.

Below are the results of the nslookup commands you requested. I undid the changes I made in post #17 before doing nslookup.

D:\Users\Jeff\Desktop>nslookup
Default Server: Unknown
Address: 192.168.0.1
> info.domain.com
Server: Unknown
Address: 192.168.0.1
****** Unknown can't find info.domain.com: Non-existent domain
> info.domain.com.
Server: Unknown
Address: 192.168.0.1
****** Unknown can't find info.domain.com.: Non-existent domain
> set type=soa
> domain.com
Server: Unknown
Address: 192.168.0.1

domain.com
primary    name server = domain.com
responsible mail addr = do—not-reply.fw—notify.net
serial    = 1444215817
refresh = 10800 (3 hours)
retry    = 900 (15 mins)
expire    = 604800 (7 days)
default    TTL = 60 (1 min)
domain.com     nameserver = domain.com
domain.com    internet address = 192.168.1.100
--------------------------------------------------------------------
Sophos UTM 9.714-4 - Home User
Currently testing VM on i3-9100 @ 3.60 GHz
16 GB RAM
Dell Optiplex XE
Intel Core 2 Duo CPU E8600 @ 3.33GHz
8GB RAM
--------------------------------------------------------------------
Cancel
Vote Up 0 Vote Down

Cancel
0 adhodgson over 9 years ago

Hi,

Thanks for the output, which shows that your UTM is indeed returning the data from the zone for all hosts.

Where my config differs is that I don't have a hostname for domain.com, and if I create that I get the same issue as yourself.  This in fact masks all the other records for that domain, including MX etc.

A few thoughts:

1.  Remove the domain.com and get people to use www.domain.com instead;
2.  Remove the domain.com hostname which will delete the zone as well, and look at creating a SNAT rule which points HTTP traffic destined to the public IP address from internal clients to the internal web server.  Only issue I can see from my tests is that internal clients IP addresses show up in the logs as coming from the UTM internal address.  Here is a forum post about this:

https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/39069

Sorry about that,
Andrew.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jeff x over 9 years ago

Thanks, Andrew. I appreciate you taking the time to test it in your environment and for the suggestions.

I'll stick with Bob's suggestion which are the settings I listed in post #17. With these settings, the logs show the clients' correct IP addresses whether they be internal or external.

--------------------------------------------------------------------
Sophos UTM 9.714-4 - Home User
Currently testing VM on i3-9100 @ 3.60 GHz
16 GB RAM
Dell Optiplex XE
Intel Core 2 Duo CPU E8600 @ 3.33GHz
8GB RAM
--------------------------------------------------------------------
Cancel
Vote Up 0 Vote Down

Cancel