3 ms·

Also services using split horizon DNS: i.e. it is publicly available service, but only when used from outside. When used from inside, it is not routed through p

Also services using split horizon DNS: i.e. it is publicly available service, but only when used from outside. When used from inside, it is not routed through public interface, but resolved directly to it's internal IP.

wink 5y ago
I'm pretty sure I'm lacking experience in administering a huge network to spot the obvious? problem, but for smaller setups I've never understood why you would do this anyway and not treat it as "external first" by putting it in a sort of DMZ and treat your internal users as "quasi-external" ones by routing them into the DMZ via another means... Of course this has the downside if you have actual 'internal only' stuff, but those could be separated from the split stuff... Just too much work with years (decades) old setups?
- vetinari 5y ago
  In DMZ, it still has an IP from private range, ergo, still treated as internal -- it doesn't matter whether it is in the same subnet as your users, only whether it falls into the range that the browser considers private. So it doesn't solve anything here.
  - wink 5y ago
    Maybe our understanding of DMZ is different, for me it's not necessarily with an internal IP - so to clarify, what I meant was hosting it on-premise, but only accessible via it's public IP (as the service is public anyway), which shouldn't be slower if your physical route isn't any longer.
- blincoln 5y ago
  At bigger, established corporations, I've seen internal web apps that need external access available set up this way, but when accessed via the public IP, a second auth factor is required. IIRC, MS Exchange's web interface was the most smooth, where the only difference to the end user was an additional field for the MFA code. If an organization is using the "BeyondCorp" approach, it doesn't seem relevant, but that's tough to bolt onto large, complex existing environments IMO. Edit: just to clarify, the advantage is similar to what "BeyondCorp" gets you - end users just need to remember the one URL, regardless of where they're connecting from.
  - wink 5y ago
    good point, I hadn't thought of that because I personally never had that. yeah
- inetknght 5y ago
  I use split horizon networking to, eg, provide public DNS entries to a public canary server. Then on the private network a different DNS server provides correct (LAN-only) addresses. This way I can see if/when private hostnames are leaked to some entity. I have about two dozen devices on my private LAN so I wouldn't consider myself to be "big" or "enterprise". The setup is fairly unusual though because most users (and unfortunately many developers) lack the technical know-how for it.

wink 5y ago

I'm pretty sure I'm lacking experience in administering a huge network to spot the obvious? problem, but for smaller setups I've never understood why you would do this anyway and not treat it as "external first" by putting it in a sort of DMZ and treat your internal users as "quasi-external" ones by routing them into the DMZ via another means... Of course this has the downside if you have actual 'internal only' stuff, but those could be separated from the split stuff... Just too much work with years (decades) old setups?

vetinari 5y ago
In DMZ, it still has an IP from private range, ergo, still treated as internal -- it doesn't matter whether it is in the same subnet as your users, only whether it falls into the range that the browser considers private. So it doesn't solve anything here.
- wink 5y ago
  Maybe our understanding of DMZ is different, for me it's not necessarily with an internal IP - so to clarify, what I meant was hosting it on-premise, but only accessible via it's public IP (as the service is public anyway), which shouldn't be slower if your physical route isn't any longer.
blincoln 5y ago
At bigger, established corporations, I've seen internal web apps that need external access available set up this way, but when accessed via the public IP, a second auth factor is required. IIRC, MS Exchange's web interface was the most smooth, where the only difference to the end user was an additional field for the MFA code. If an organization is using the "BeyondCorp" approach, it doesn't seem relevant, but that's tough to bolt onto large, complex existing environments IMO. Edit: just to clarify, the advantage is similar to what "BeyondCorp" gets you - end users just need to remember the one URL, regardless of where they're connecting from.
- wink 5y ago
  good point, I hadn't thought of that because I personally never had that. yeah
inetknght 5y ago
I use split horizon networking to, eg, provide public DNS entries to a public canary server. Then on the private network a different DNS server provides correct (LAN-only) addresses. This way I can see if/when private hostnames are leaked to some entity. I have about two dozen devices on my private LAN so I wouldn't consider myself to be "big" or "enterprise". The setup is fairly unusual though because most users (and unfortunately many developers) lack the technical know-how for it.