1

We have a webserver on our LAN. Externally, we can use the public domainname (let's say business.com) to access the website. Internally, we need to use the local IP. We also want to use the public domainname internally.

When we use the public domainname, it points to the public IP, and cannot access it.

Here are some (what I think) related config lines in the cisco router.

     interface Vlan10
     ip address 192.9.200.253 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
     ip tcp adjust-mss 1412
    !
    interface Vlan20
     ip address *external ip 1* 255.255.255.248
     ip nat outside
     ip virtual-reassembly in



ip domain name business.com
    ip host www.business.com. *external ip 1*
    ip name-server 8.8.8.8
    ip name-server 195.238.2.21
    ip name-server 4.4.4.4
    ip name-server 195.238.2.22


    ip dns server
    ip nat inside source list nat-list interface Vlan20 overload
    ip nat inside source static tcp 192.9.200.175 80 *external ip 1* 80 extendable

    ip route 0.0.0.0 0.0.0.0 *external ip 0*
    !
    ip access-list extended nat-list
     deny   ip 192.9.200.0 0.0.0.255 host 192.9.200.90
     deny   ip 192.9.200.0 0.0.0.255 host 192.9.200.94
     permit tcp any any
     permit udp any any
     permit icmp any any
     deny   ip 192.9.200.0 0.0.0.255 host 192.9.200.175

Some extra info:

VLAN10 = LAN side, VLAN20 = WAN side.

192.9.200.253 = router IP

192.9.200.175 = webserver IP

I've tried changing

ip domain name cisco.business.com
        ip host www.business.com. *external ip 1*

To

ip domain name business.com
        ip host www.business.com. 192.9.200.175

But that didn't fix the issue.

If there is any more info needed, let me know.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 9:58
2

Depending on the firewall type, hairpinning can get pretty messy.

A much cleaner solution is to use split-brain DNS - on the internal DNS server you simply resolve the server's name to the private LAN IP address. Very often, this is much faster as well as it bypasses the firewall.

You need to make sure that each client is getting the hostname resolved to the private IP address, ie. use the DNS server with the split-brain setup.

| improve this answer | |
  • This is exactly what I want and need. I thought by setting the host table like this: "ip host www.business.com. 192.9.200.175", that the cisco router would be smart enough to use that IP address instead of resolving it via the external DNS. When I google split-brain DNS, it's all about setting this up with dedicated DNS servers where you can configure zones... I'm not sure if this could be done with the Cisco router... – RobbeM Nov 8 '18 at 8:01
  • Are you sure you're using the Cisco as DNS server? Likely, the host record is just for the router which won't help. The clients need to resolve the internal IP. – Zac67 Nov 8 '18 at 8:51
  • Split-horizon DNS is the way to go – Ben Personick Nov 8 '18 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.