2 ms·

> Example: split-horizon DNS. You're connected to a VPN network but you're only routing some subnets through that, not everything. Thus, you have to have DNS th

> Example: split-horizon DNS. You're connected to a VPN network but you're only routing some subnets through that, not everything. Thus, you have to have DNS that query some DNS server inside the VPN for a set of domains, but keep using the usual DNS servers for everything else. Why. I want to route 10.0.0.0/8 via a VPN, I don't know if "flargle.bazonga.com" resolves to 10.0.0.1 or 99.99.99.99 until I do the lookup.

znpy 5y ago
You might know beforehand. Your employer might have the whole intranet.employer.tld within the VPN. And everything within that network resolves to some 10.8.0.0/8 address.
- iso1631 5y ago
  I might, but that's not at all how my networks work. Indeed even the corporate business network (which I rarely ever touch) doesn't do that any more - some internal looking DNS resolve to public IPs, some external looking DNS resolve to rfc1918s, some are overwritten if you're on the network or not, and vpns are now based around zscaler which doesn't even allow access via IP address, not entirely sure how it works but DNS resolves everything to 100.64.x.x or similar (cg nat I believe) - not sure how it routes web traffic to the right server, but as I say I very rarely use it (I don't think I've used it since covid started) If I were setting up a corporate laptop, I would likely set all dns, and possibly all traffic, routing via the vpn for security/compliance/monitoring purposes. What benefit does resolvd give me?
mark-wagner 5y ago
If bazonga.com is domain only accessible through the VPN then you most likely always want to look up flargle.bazonga.com through the VPN name servers. On the internet you'll get NXDOMAIN. However, this could be solved by setting the name servers always to the VPN name servers and make them recursive. But then, what if those name servers don't have internet access?

znpy 5y ago

You might know beforehand. Your employer might have the whole intranet.employer.tld within the VPN. And everything within that network resolves to some 10.8.0.0/8 address.

iso1631 5y ago
I might, but that's not at all how my networks work. Indeed even the corporate business network (which I rarely ever touch) doesn't do that any more - some internal looking DNS resolve to public IPs, some external looking DNS resolve to rfc1918s, some are overwritten if you're on the network or not, and vpns are now based around zscaler which doesn't even allow access via IP address, not entirely sure how it works but DNS resolves everything to 100.64.x.x or similar (cg nat I believe) - not sure how it routes web traffic to the right server, but as I say I very rarely use it (I don't think I've used it since covid started) If I were setting up a corporate laptop, I would likely set all dns, and possibly all traffic, routing via the vpn for security/compliance/monitoring purposes. What benefit does resolvd give me?

mark-wagner 5y ago

If bazonga.com is domain only accessible through the VPN then you most likely always want to look up flargle.bazonga.com through the VPN name servers. On the internet you'll get NXDOMAIN. However, this could be solved by setting the name servers always to the VPN name servers and make them recursive. But then, what if those name servers don't have internet access?