Re: dnatting

[Steven M Campbell <Netfilter@SCampbell.net>]

Gary W. Smith wrote:
>I agree with everything that has been said BUT I must also interject.  A
>lot small business and many home users who get one or two IP's usually
>don't have a second DNS floating around.  For larger organizations I
>would definitely use the split DNS.  We do that at a couple locations
>when we can.
>  
Split DNS can be implemented on a single DNS server, check your DNS 
servers manual.  The basics are that you create views of your domain 
structure based on the ip address of the requester, if they are inside 
(for instance 10.0.0.0/8) you give them the inside answers, otherwise 
you give them the outside answers.   You should not need multiple DNS 
servers although you should have multiple servers for other reasons. 

>As for this case, I think it's completely acceptable.  
>
>Since this does indeed work I think it should be documented as a viable
>solution (which I think it's in the fine print on one of the docs that I
>read before).
>
>  
FWIW from me I would not accept the answer 'it works so it must be 
okay', that's been the downfall of soooo very many computer projects I 
cannot even begin to count them (a particularily bad attitude for 
programmers).    We'll certainly not argue (and we aren't), it's your 
network and your rules.  My advice is use split DNS from the experience 
that I used to do the sort of thing that you are doing here and I found 
out that it was a bad idea and only created trouble later and I don't 
like trouble, especially if it can be pinned on me!