Selfhosted

39905 readers

386 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

[email protected]

[Question] Translating public DNS to internal DNS without revealing the internal DNS (feddit.nu)

submitted 3 months ago* (last edited 3 months ago) by [email protected] to c/[email protected]

4 comments fedilink hide all child comments

So I've got a Consul cluster running for service discovery on a set of servers, some of which have public IP addresses. On some of these nodes I want to run Traefik (dynamically registered), which are registered on tfk.service.consul which holds a number of A and AAAA records. I want my address tfk.example.com to point at those A-records without revealing the consul address.

How would I do this?

Example:

Some application maps internal A-records to public A-records.

public             | internal               / xxx.xxx.xxx.xxx
tfk.example.com -- | -- tfk.service.consul -- yyy.yyy.yyy.yyy
                   |                        \ zzz.zzz.zzz.zzz

Expected result:

Public DNS resolvers never see the consul query.

public           / xxx.xxx.xxx.xxx
tfk.example.com -- yyy.yyy.yyy.yyy
                 \ zzz.zzz.zzz.zzz

I know I could use consul-template for this purpose by rendering config files to bind or similar, but I was wondering if there was some way to do this via DNS like some kind of bridge application.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 2 points 3 months ago (1 children)

I'm aware that this isn't how DNS works, but I'd imagine it is possible to have a DNS server that when it receives a query from the internet looks at the requested domain and translates it to an internal domain and in turn query that one, returning the result without revealing the internal domain. Something like a ALIAS virtual record provided by some services (but wont work against a internal DNS).

As for Traefik acting as a reverse proxy for internal network addresses, yeah that's the way it works. However in this case I have several instances of Traefik running on a subset of IP-addresses on a public subnet. So essentially we want to loadbalance several Traefik loadbalancers using DNS.

[–] [email protected] 3 points 3 months ago

Apparently you can kind-of rewrite queries on the fly with PowerDNS scripting and answer accordingly. So maybe that's what you're looking for.