2

I have a linux machine with two network interfaces. They are both connected to local networks -- one is 192.168.*.*, the other is 10.*.*.*.

The 192.168.*.* network is completely private and does not have internet access. The 10.*.*.* network does have internet access.

Currently, I can do external ping's and the names will resolve

ping google.com

However, when I try to ping a machine name on the 192.168.*.* network, the name will not resolve

ping computer-name
ping computer-name.domain
ping computer-name.domain.local

If I specify an IP address, it will resolve

ping 192.168.x.x

How can I set up DNS settings so that the machine names on the private local network will resolve, but I can still resolve external addresses?

I am using Centos6.

  • 1
    You'll need to setup a DNS server (e.g. dnsmasq) which may be fairly involved or kluge things together in the 1970s style with /etc/hosts entries. – thrig Feb 22 '17 at 0:30
  • @thrig Both networks have DNS servers. The problem is that the 192.168.*.* DNS server obviously can't resolve external addresses. Is there a way to point to multiple DNS servers? Or to somehow direct certain requests (like all domain.local lookups) to a certain DNS? – Brendan Abel Feb 22 '17 at 0:34
  • @BrendanAbel, ignoring the networks, does the private DNS on 192.168 cover its own domain? You're not trying to merge items from two different servers into a single domain of "company.com" or such, are you? – BowlOfRed Feb 22 '17 at 0:46
  • @BowlOfRed No, there is no merging. 192.168.*.* has it's own domain – Brendan Abel Feb 22 '17 at 0:47
  • Then @thrigs comment is appropriate. You run your own server. You direct queries from the domains and networks covered to the servers responsible for them. The standard unix client resolver can't handle doing this all by itself. – BowlOfRed Feb 22 '17 at 0:52
3

The local resolver libraries assume that any nameserver can resolve all names. In your case, you can get the side effect that if your local one isn't authoritative, it won't respond. Then your libraries will retry (after a delay) with the next nameserver.

Better would be to run a local nameserver that will send the data to the correct location quickly. If you install dnsmasq, the meat of the config is pretty simple. Something like:

/etc/dnsmasq.conf

# This sets up your private domain
server=/privatedomain/192.168.10.15
server=/.168.192.in-addr.arpa/192.168.10.15

You don't even have to mention the main server (10.10.1.15) if it's listed as a nameserver in your resolv.conf. If it gets a request for privatedomain, it goes to the local server. If it gets a request for anything else, it uses the non-localhost servers in resolv.conf.

Then just set up your server as the first one in resolv.conf.

resolv.conf

search privatedomain
nameserver 127.0.0.1
nameserver 10.10.1.15
0

I was able to get this working by modifying my /etc/resolv.conf file

domain privatedomain
search privatedomain publicdomain.com
nameserver 192.168.10.15
nameserver 10.10.1.15

The privatedomain is the local 192.168.*.* network domain name. The publicdomain.com is the domain name for the 10.*.*.* network with internet access.

It can now resolve all these requests correctly

ping computer.privatedomain
ping computer
ping computer2.publicdomain.com
ping google.com

The only downside to this is that when I try to resolve a name that isn't reachable from the private domain, there is a noticeable delay. For example:

ping google.com

I imagine it's because it's first attempting to resolve the name via the first nameserver on the privatedomain, which will eventually timeout, and then goes to the second nameserver which is able to resolve it.

  • ... which is why the other answer is better. It doesn't state it explicitly, and explains things in terms of dnsmasq, but what it is indirectly telling you to do is to set up split horizon DNS service with queries for the private part of the DNS namespace forwarded to one resolving proxy DNS server (192.168.10.15) and queries for the rest of the DNS namespace forwarded to another resolving proxy DNS server (10.1.1.15). /etc/resolv.conf alone does not achieve this. A proxy DNS server (e.g. dnscache, dnsmasq) configured with a split in the DNS namespace, does. – JdeBP Feb 22 '17 at 6:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.