 Re: nat in DNS packet
I have just had a look at that article and looking at it then it seems that it works as you are doing NAT on the gateway as you have an overlapping address space, and you are static nat the networks that overlap at each gateway. ie any traffic leaving the gateway A is NAT from 10.0.0.0/8 to 11.0.0.0/8
ie the DNS reponse is translated from 10.x.x.x to 11.x.x.x as opposed to 40.40.40.40 to 10.10.10.2 or whatever is internally.
I am not sure that is relevant to the original query.
I would say that original query is more that is accessing a public facing DNS Server to try and resolve internal IP addresses rather then having seperate public and private DNS Servers. ie mydomain.com is internal and externally used and is using a single DNS Server to resolve from internal net and the Internet.
A better solution and more secure for that is to have a DNS Server internally that responds with internal IP addresses and a seperate DNS Server that is accessed from the Internet to resolve the public IP for the domain.
That way your internal DNS Server is not accessed from the outside world.
Certainly that is the way that I would do it.  |