Hey everyone and welcome back. So now what I want to talk to you about is the concept
of something known as split DNS. So what exactly is split DNS and why would we use it? So imagine
an internal network and we also have an external network. So what do I mean when I say this?
Imagine that we have maybe a web server that is used for public consumption. You know the way
you can go to CBTNuggets.com as a user of CBTNuggets and from the comfort of your house you can
access CBTNuggets servers. This is ultimately external access. You know you're not actually a
part of CBTNuggets local network. You're accessing your services over the internet. Now when you
happen to access our servers you go into your web browser and you type in you know CBTNuggets.com
and as we've discussed DNS is going to resolve this hostname, return to you an IP address and your
browser can make that connection to our services. Again the key point here is that this is external.
So whether it is CBTNuggets or it is another company let's maybe just say Google for example.
We want to be able to have that clear delineation and separation of the external network from the
internal network. So like I say users can access public services but what if and again I'm just
guessing here but what if Google had a human resources department and I'm sure they actually
do have a human resources department. They are a very large corporation after all that dealt with
issues related to their internal employees. Really there is no need for these types of services
to be exposed to the public. So when someone who is within the company perhaps wants to go to
hr.google.com they would actually like this domain to be resolved and resolve to you know like a
private IP address within the company network. So 192,168 maybe 50.1 say for example. Whereas
someone who is out with the local network i.e a regular user like you or I they would not
have any use or any business quite frankly accessing this domain. So clearly here we have
two different purposes with respect to DNS and this is really what split DNS is all about. So one
of the ways we can actually separate this is by having two different DNS servers. So one DNS server
is going to handle internal requests and the other one is going to handle external requests. So that
means if someone who is within the network makes a request to say for example google.com they can
actually query the local DNS server and get a completely different result from someone who
would access this information via the external DNS server. So really all you do is within your
internal server you would just create another zone file for that particular domain say for example
google.com. So that would mean that local users are going to query the internal DNS server to get
the internal DNS results relating to say for example private IP address information and
domain name information. However those users will still have a need to access and consume
public internet services let's maybe say they want to go to wikipedia.org to do some research for
example. Well our private DNS server is not necessarily going to be configured to have this
information so what is ultimately going to happen is for information that the private DNS server does
not have it can then forward that request to the external server and then the external server
just like it ordinarily would would go through the process of resolving that information. So think
about it we have an internal user right here who has access to an internal DNS server so if this
user accessed internal resources within their company they would get this private information
returned back to them. However if they try to access the regular public internet and this
DNS server does not have that information that DNS server is just simply going to forward that
information to the external DNS server which is also configured and this one can then handle that
request meaning that this user can get both private internal DNS information as well as also resolve
generic information over the public internet. So this is a really good way to separate and secure
your private internal DNS servers because the alternative would be is that you place these
records all in the same external public DNS server that everyone else could be using. Now the problem
with this is that you're leaking private data things like your private IP addressing and your
private domain names that you don't want to be accessible to the public. So really at its core
split DNS is really all about that it's about separating this out and giving those users
the ability to access this information in a private way and without compromising their ability to
utilize and consume regular public services that you would ordinarily use on the internet say for
example. So really for the purposes of the LPIC2 examination this is really the concept we want
to understand why would we have a split DNS configuration we want that nice separation of
our private services from our public services and we want to understand some basic core components
notably that both the internal and external DNS servers both of these would actually be
configured to be master servers. Remember we talked about that in the previous nuggets also
like I say we want to be remembering that for requests that the internal DNS server
cannot resolve these can be forwarded to the external DNS server and it's ultimately using
this architecture that is going to allow you to protect your internal systems so that they are not
accessible outside of your private internal network and those really are the main concepts of split
DNS that we have to understand for the purposes of the examination so I hope this has been informative
for you I'd like to thank you for viewing.