Home / server / Questions / 1167008
Accepted
VPNer
Asked: 2024-10-24 19:50:52 +0800 CST

Windows DNS Server configuration for a specific subdomain and redirect the rest to authority

  • 772

The application stack has multiple components. e.g. api, public application and internal application. I want to make internal application only accessible from internal network IP ranges. I configured my nginx (reverse proxy) to allow only certain IP ranges (e.g. 192.168.1.0/24). I am using a domain name: mydomain.com

Let's say that the internal application is using the subdomain app.mydomain.com There is also a website (running externally) under (www.)mydomain.com The external DNS (authority) is configured to point to my server's public static IP, which is needed for the public API (e.g. api.mydomain.com).

But on the local network (incl. VPN), I want to direct the traffic internally. For instance, instead of the public IP, PCs should use the local IP, so that only those with local IP will be allowed by the nginx reverse proxy. To do this, I am configuring the Windows AD server also running a DNS Server. I am trying to configure this DNS to direct computers in the network to the server on the local network.

When I try to define a primary zone for mydomain.com with an entry for app.mydomain.com to point to the internal server address, nslookup app.mydomain.com is returning the local IP but mydomain.com or www.mydomain.com do not work anymore.

Is there a way to point for all the other subdomains to the external DNS (authority)?

When I try to configure a secondary zone, the transfer fails. I think that the authority (external DNS) does not let me to do that.

I wonder how can achieve this?

domain-name-system

1 Answers

  1. Best Answer

    You can achieve this by creating a primary zone called app.mydomain.com and creating an empty A record in it pointing to the internal IP address of your server; this works because an empty record matches the name of the zone itself instead of an actual hostname inside it.

    This way, the DNS server will only believe to be authoritative for the app.mydomain.com zone, but not for the higher-level mydomain.com zone; thus, queries for all other contents in the zone will be resolved in the standard way (either recursion from root servers or a forwarder if you configure one).

    • 1