Skip Navigation
Selfhosted @lemmy.world
freddo @feddit.nu
Question

Translating public DNS to internal DNS without revealing the internal DNS

So I've got a Consul cluster running for service discovery on a set of servers, some of which have public IP addresses. On some of these nodes I want to run Traefik (dynamically registered), which are registered on tfk.service.consul which holds a number of A and AAAA records. I want my address tfk.example.com to point at those A-records without revealing the consul address.

How would I do this?

Example:

Some application maps internal A-records to public A-records.

 
    
public             | internal               / xxx.xxx.xxx.xxx
tfk.example.com -- | -- tfk.service.consul -- yyy.yyy.yyy.yyy
                   |                        \ zzz.zzz.zzz.zzz
Expected result:

Public DNS resolvers never see the consul query.

 
    
public           / xxx.xxx.xxx.xxx
tfk.example.com -- yyy.yyy.yyy.yyy
                 \ zzz.zzz.zzz.zzz

I know I could use consul-template for this purpose by rendering config files to bind or similar, but I was wondering if there was some way to do this via DNS like some kind of bridge application.

4 comments

  • What you want is bind views. You can configure bind to resolve different views for different segments allowing you to have the same (sub) domains to different ips

  • That's not how DNS works. If you publicly query tfk.example.com it'll reply with a records associated to that entry and that's it. The client then attempts to connect to those IP addresses and no further DNS queries are made (assuming there's no CNAME records). If you want to use DNS for that then you'll need to add entries directly to tfk.example.com which point to your internal addresses.

    So, you need to change tfk.example.com records whenever IP addresses change, most likely via some kind of API to automate things, assuming you don't directly control name servers for tfk.example.com by yourself.

    But, as you're running a proxy anyways it doesn't reveal internal addresses and the client needs only public addresses to connect into. I haven't heard about traefik before, so I don't have a clue on how it works, but 'traditional' proxies effectively hide everything on the 'LAN' side. (Yes, I know, it's not necessarily/strictly speaking LAN).

    • I'm aware that this isn't how DNS works, but I'd imagine it is possible to have a DNS server that when it receives a query from the internet looks at the requested domain and translates it to an internal domain and in turn query that one, returning the result without revealing the internal domain. Something like a ALIAS virtual record provided by some services (but wont work against a internal DNS).

      As for Traefik acting as a reverse proxy for internal network addresses, yeah that's the way it works. However in this case I have several instances of Traefik running on a subset of IP-addresses on a public subnet. So essentially we want to loadbalance several Traefik loadbalancers using DNS.