Cut to the chase:
A specific question of mine is this: a client on 10.0.3.X/24 network cannot reach
subdomain.site.com. How can I make clients on 10.0.2.X/24 and 10.0.3.X/24 able to resolve 10.0.1.4 when calling
I'd like to get my DNS resolution working for my web server LAN using the WAN-side domain name e.g.
subdomain.site.com such that n clients on any of the LAN sub networks can just type
site.com and be routed appropriately (scalable, so
/etc/hosts is out of the question).
My LAN has multiple subnets created with LEDE (network .1) and OpenWRT (network .2 and network .3):
10.0.1.X/24 Main puppy with WAN interface facing internet and NAT, web server fixed at 10.0.1.4 with ports forwarded 10.0.2.X/24 Auxiliary router with WAN interface facing 10.0.1.X/24 (routed) 10.0.3.X/24 Auxiliary router with WAN interface facing 10.0.1.X/24 (routed)
I do not want any hairpin NAT/loopback NAT solutions. I'd prefer a solution using DNS and here is why:
- An outgoing call from a client calls authoritative DNS to find the IP (for routing!), then sends a packet to that destination,
- which upon arriving, gets DNATed to the server.
- The source IP is the client's local address, so the server calls the client directly (using the packet's source IP).
- Client rejects this package because it expects it to come from the gateway, indirectly from the gateway's ext. addr. provided by DNS above.
- A NAT loopback solves the issue by translating the outbound source IP to the gateway's LAN-side addr. such that the
- Server then responds to the gateway, rather than directly to the client. Cool beans.
The problem with this data flow is that it is not efficient to leave the LAN and contact a global DNS server for an IP addr. when the server is a local peer (on the same side of NAT and in my case not necessarily within the same local subnet). Why even leave LAN when the client and server are local peers? A nice explanation of a loopback NAT flow can be found here, https://unix.stackexchange.com/a/282094/33386.
I know it is possible to achieve what I want using DNS split-horizons or whatever hip term some people are calling it these days. Also a local naming server that takes precedence over the global naming servers in certain instances would solve this. How can I implement this in OpenWRT or LEDE when using multiple subnets (multiple DHCP+DNS servers)? Somebody has to have done this already.
Currently, clients on 10.0.1.X/24 can reach
subdomain.site.com with a corresponding dnsmasq setting
/etc/config/dhcp but I have no clue why, because I thought this does not cover subdomains:
config domain option name 'site.com' option ip '10.0.1.4' # LAN address of web server