DHCP/BIND and ddns to update two subnets

gudlyf · 05-24-2012, 01:09 PM

I have DHCP and BIND working fine to provide dynamic updates as we bring new servers online. I've got what might be a rather complicated setup beyond that which I'm hoping is possible without home-grown scripting.

We have two locations connected via VPN. Both locations use IPs in the 192.168.1.0/24 subnet. So, with the VPN, we map IP addresses such that to get to location1 we can hit 192.168.10.0/24 and to get to location2 it/s 192.168.20.0/24. Works great.

However, with the DHCP setup at location1, the DNS server there updates fine (let's say it put 'server1.domain.com' at 192.168.1.20), but we need to now get our DNS at location2 to know that 'server1.domain.com' is reachable at 192.168.10.20.

Right now we manually add the entries to the DNS server at location2. That's not very sustainable. Is what I'm trying to do possible?

Thanks!

Ser Olmy · 05-25-2012, 06:18 AM

There's no way to tell the DHCP server to update the record for an entirely different IP address than the one it just assigned. Also, it is not possible to tell a DNS server to send mangled updates to a slave server.[1]

The main problem here is that you're using the same subnet at to different locations, and are using NAT to hack your way around the problem. If you have administrative control over both locations, switching the subnet at one of them should be no big deal.

[1]Actually, some Cisco equipment (ASA firewalls) has the ability to mangle DNS packets between NATed hosts, provided it's the Cisco equipment that does the NATing. It works for simple A record requests, not sure if it can handle DDNS updates or zone transfers (probably not). And signing DNS zones breaks this functionality anyway.

gudlyf · 05-25-2012, 12:58 PM

Not the most elegant solution, but this is working for us for now. Very hacky. Runs via cron every 5-10 mins:

Code:

#!/bin/bash

NSUPDATE='nsupdate -t 5'
DNSSERVER='192.168.60.79'

DNSCHANGES=$(grep -i "Added new forward map" /var/log/messages | grep map | grep "168" | awk '{print $11 ":" $13;}')

for i in $DNSCHANGES
do
  hostname=`echo $i | cut -d ":" -f 1`
  ip=`echo $i | cut -d ":" -f 2 | sed 's/192\.168\.1/192\.168\.50/'`
  COMMANDS="
server $DNSSERVER
key coloupdate blahblahblahkeyhere
zone ourdomain.com
update delete $hostname
update add $hostname 1 A $ip
send"
echo -e "$COMMANDS" | $NSUPDATE
done

Ser Olmy · 05-25-2012, 02:33 PM

Quote:

Originally Posted by gudlyf

Not the most elegant solution, but this is working for us for now. Very hacky. Runs via cron every 5-10 mins:

Nice. Adds a whole new dimension to the concept "zone transfers". Although you could probably have reconfigured one of the subnets in less time than it took to write that script.