3 ms·

> Essentially you should always use a domain you control both outside and inside, like a regular gTLD or ccTLD. Yep. We use two domains - everything on A is "p

> Essentially you should always use a domain you control both outside and inside, like a regular gTLD or ccTLD. Yep. We use two domains - everything on A is "public" and everything on "B" is internal. The root of "B" is a static page on AWS that is gated behind our VPN so it serves as a quick "can you hit our infra at all" check when troubleshooting, and catches the people who are convinced they've enabled their VPN. One thing to note here that we haven't solved (We've only got two "infra" people, we're a small company) is how you handle an internal portal to an external service. If our public domain is maccard.com and private is maccard.dev, where does internal-admin.maccard.com _actually_ live? Our solve for this is we have an internal.maccard.com for this very specific use case, but I'd much rather it was admin.live.maccard.dev

justusthane 3y ago
We just use the same domain internally and externally with split DNS. Works fine.
- justsomehnguy 3y ago
  Until it doesn't. And having a website on the domain.tld adds shenanigans. One of many examples I had is when Outlook loses connection to Exchange (eg S2S VPN is down) it starts autodiscovery process, hits domain.tld (because users have email@domain.tld, duh) and complains to user with a scary messages (which are also blocks the process until the users hit something). Which is totally understandable, because the website is on some public hosting, so CN in the cert is from the public host at best and != domain.tld. Using corp.domain.tld or even techdomain.tld solves this totally and also let you use public certs (LE in the current era) even on the 'local' side of the network.
- maccard 3y ago
  We have enough issues with DNS that adding split DNS into the mix is a ball ache I don't want to contend with. We actually have the DNS for our private domain set publicly, and all the actual work happens on a load balancer which is on the network. We're fully remote so this avoids the "my communal WiFi provider seems to have issues with the VPN" (which is what we had when we used split DNS)
  - noAnswer 3y ago
    I buried split DNS (and (for the most part) private CAs for that matter) with ACME DNS-01.
- johannes1234321 3y ago
  Aside from all technical issues the biggest problem I have seen with such an approach is that is really hard for employees to remember what is external and what internal that way. Distinct domains help there
- NewJazz 3y ago
  We use split DNS and the admins can't even do it right, they keep fucking it up and configuring one DNS view but not the other, so when I'm on VPN I randomly can't use certain domain names. Also as another commenter mentioned, it is impossible to tell based on the name if it is an internal or external resource I'm curious what split DNS offers that a separate internal zone wouldn't.
- pydry 3y ago
  https://en.wikipedia.org/wiki/2021_Facebook_outage https://en.wikipedia.org/wiki/2021_Facebook_outage made me think this wasnt such a great idea. particularly the part about facebook employees not being able to use their keycards to enter the buildings at the same time as the site outage.

justusthane 3y ago

We just use the same domain internally and externally with split DNS. Works fine.

justsomehnguy 3y ago
Until it doesn't. And having a website on the domain.tld adds shenanigans. One of many examples I had is when Outlook loses connection to Exchange (eg S2S VPN is down) it starts autodiscovery process, hits domain.tld (because users have email@domain.tld, duh) and complains to user with a scary messages (which are also blocks the process until the users hit something). Which is totally understandable, because the website is on some public hosting, so CN in the cert is from the public host at best and != domain.tld. Using corp.domain.tld or even techdomain.tld solves this totally and also let you use public certs (LE in the current era) even on the 'local' side of the network.
maccard 3y ago
We have enough issues with DNS that adding split DNS into the mix is a ball ache I don't want to contend with. We actually have the DNS for our private domain set publicly, and all the actual work happens on a load balancer which is on the network. We're fully remote so this avoids the "my communal WiFi provider seems to have issues with the VPN" (which is what we had when we used split DNS)
- noAnswer 3y ago
  I buried split DNS (and (for the most part) private CAs for that matter) with ACME DNS-01.
johannes1234321 3y ago
Aside from all technical issues the biggest problem I have seen with such an approach is that is really hard for employees to remember what is external and what internal that way. Distinct domains help there
NewJazz 3y ago
We use split DNS and the admins can't even do it right, they keep fucking it up and configuring one DNS view but not the other, so when I'm on VPN I randomly can't use certain domain names. Also as another commenter mentioned, it is impossible to tell based on the name if it is an internal or external resource I'm curious what split DNS offers that a separate internal zone wouldn't.
pydry 3y ago
https://en.wikipedia.org/wiki/2021_Facebook_outage https://en.wikipedia.org/wiki/2021_Facebook_outage made me think this wasnt such a great idea. particularly the part about facebook employees not being able to use their keycards to enter the buildings at the same time as the site outage.