Selfhosted

39435 readers

9 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

[email protected]

[Question] Translating public DNS to internal DNS without revealing the internal DNS (feddit.nu)

submitted 3 months ago* (last edited 3 months ago) by [email protected] to c/[email protected]

4 comments fedilink hide all child comments

So I've got a Consul cluster running for service discovery on a set of servers, some of which have public IP addresses. On some of these nodes I want to run Traefik (dynamically registered), which are registered on tfk.service.consul which holds a number of A and AAAA records. I want my address tfk.example.com to point at those A-records without revealing the consul address.

How would I do this?

Example:

Some application maps internal A-records to public A-records.

public             | internal               / xxx.xxx.xxx.xxx
tfk.example.com -- | -- tfk.service.consul -- yyy.yyy.yyy.yyy
                   |                        \ zzz.zzz.zzz.zzz

Expected result:

Public DNS resolvers never see the consul query.

public           / xxx.xxx.xxx.xxx
tfk.example.com -- yyy.yyy.yyy.yyy
                 \ zzz.zzz.zzz.zzz

I know I could use consul-template for this purpose by rendering config files to bind or similar, but I was wondering if there was some way to do this via DNS like some kind of bridge application.

top 4 comments

sorted by: hot top controversial new old

[–] [email protected] 6 points 3 months ago* (last edited 3 months ago)

What you want is bind views. You can configure bind to resolve different views for different segments allowing you to have the same (sub) domains to different ips

[–] [email protected] 4 points 3 months ago (1 children)

That's not how DNS works. If you publicly query tfk.example.com it'll reply with a records associated to that entry and that's it. The client then attempts to connect to those IP addresses and no further DNS queries are made (assuming there's no CNAME records). If you want to use DNS for that then you'll need to add entries directly to tfk.example.com which point to your internal addresses.

So, you need to change tfk.example.com records whenever IP addresses change, most likely via some kind of API to automate things, assuming you don't directly control name servers for tfk.example.com by yourself.

But, as you're running a proxy anyways it doesn't reveal internal addresses and the client needs only public addresses to connect into. I haven't heard about traefik before, so I don't have a clue on how it works, but 'traditional' proxies effectively hide everything on the 'LAN' side. (Yes, I know, it's not necessarily/strictly speaking LAN).

[–] [email protected] 2 points 3 months ago (1 children)

I'm aware that this isn't how DNS works, but I'd imagine it is possible to have a DNS server that when it receives a query from the internet looks at the requested domain and translates it to an internal domain and in turn query that one, returning the result without revealing the internal domain. Something like a ALIAS virtual record provided by some services (but wont work against a internal DNS).

As for Traefik acting as a reverse proxy for internal network addresses, yeah that's the way it works. However in this case I have several instances of Traefik running on a subset of IP-addresses on a public subnet. So essentially we want to loadbalance several Traefik loadbalancers using DNS.

[–] [email protected] 3 points 3 months ago

Apparently you can kind-of rewrite queries on the fly with PowerDNS scripting and answer accordingly. So maybe that's what you're looking for.