• Overview
• Before you begin
• Option 1: Conditional forwarders on your internal DNS server (recommended)
• Option 2: Local DNS forwarder on the Access Tier host
• Verify from an end-user device

Overview

An Access Tier runs on a Linux server or virtual machine in your private network, called the Access Tier host on this page. The Access Tier forwards end-user requests to your private services, so it must resolve the names of those services, both your private domains and the service backend names, to private IP addresses. By default, the Access Tier sends every DNS query to the DNS servers that the Access Tier host is configured to use. For example, if the host uses 10.0.0.2 as its DNS server, the Access Tier sends all of its queries to 10.0.0.2, so 10.0.0.2 must be able to resolve every private domain.

In most networks, one internal DNS server resolves all of your private domains, and this default behavior needs no further configuration. Other networks have more than one internal DNS server, and each server resolves different domains. For example:

In this case, the DNS server that the Access Tier host uses cannot resolve every private domain. The Access Tier then cannot resolve names in the other domains, and end users cannot reach the services in them. To fix this, set up DNS forwarding. A forwarding rule tells a DNS server to send the queries for one domain to the DNS server that resolves that domain. This page describes two places to add these rules:

• Option 1 is recommended. It adds the rules to the internal DNS server that the Access Tier host already uses. Use this option if you can change the configuration of that DNS server.
• Option 2 adds the rules to a DNS forwarder that you install on the Access Tier host itself. Use this option if you cannot change your internal DNS servers and the Access Tier was installed with a package or tarball.

Before you begin

• List (i) each private domain and (ii) the IP address of each DNS server that resolves it. If you are moving from a SonicOS firewall Connector, these are the domains and DNS servers in the firewall’s Split DNS configuration.
• Add each domain as a private domain of the Access Tier. A private domain entry covers every subdomain beneath it, so corp.example.com also covers portal.corp.example.com. The Access Tier has no wildcard entries, so if the firewall’s Split DNS configuration lists a wildcard entry such as *.corp.example.com, add only corp.example.com.
• Find the IP addresses of the DNS servers that the Access Tier host uses. You need them for either option, because Option 1 adds the forwarding rules to these servers and Option 2 sends all other queries to them. To find them, open a terminal on the Access Tier host and run cat /etc/resolv.conf. Each nameserver line holds the IP address of one DNS server. If the only entry is nameserver 127.0.0.53, the host runs systemd-resolved, which answers on that local address and passes queries on to the real DNS servers. In that case, run resolvectl status, and read the addresses under DNS Servers.

Option 1: Conditional forwarders on your internal DNS server (recommended)

Add the forwarding rules to the internal DNS server that the Access Tier host already uses. This option is recommended for two reasons:

• You do not change anything on the Access Tier host. The Access Tier keeps sending its queries to the same DNS server.
• You manage the forwarding rules on your DNS server, with the rest of your DNS configuration, instead of in a separate file on the Access Tier host.

1. On the DNS server that the Access Tier host uses, create one forwarding rule for each private domain, and point each rule to that domain’s DNS servers. On Windows Server DNS, this rule is a conditional forwarder. On BIND and Unbound, it is a forward zone.

2. Confirm that the DNS server that the Access Tier host uses has network connectivity to each DNS server that its forwarding rules point to. The first server forwards queries to the others, so no firewall or routing rule between them can block DNS traffic on port 53, over UDP and TCP.

3. From the Access Tier host, confirm that a name in each domain resolves:

dig +short portal.corp.example.com
dig +short rds.lab.example.local

Option 2: Local DNS forwarder on the Access Tier host

If you cannot change your internal DNS servers, run a local DNS forwarder on the Access Tier host. The forwarder sends queries for each private domain to the DNS servers for that domain, and sends all other queries to the host’s usual DNS servers. This option applies to an Access Tier installed with a package or tarball, which runs directly on the host. This section uses dnsmasq to show a sample configuration file. dnsmasq is an example, not a requirement.

Note: dnsmasq is third-party software. Install and maintain it according to your Linux distribution’s documentation and the dnsmasq manual page.

The following dnsmasq configuration file, for example /etc/dnsmasq.d/private-domains.conf, matches the example in the Overview:

# Listen only on the loopback address
listen-address=127.0.0.1
bind-interfaces

# Take upstream servers from this file only, not from /etc/resolv.conf
no-resolv

# Send each private domain, and its subdomains, to the DNS servers for that domain
server=/corp.example.com/10.1.1.10
server=/corp.example.com/10.1.1.11
server=/lab.example.local/172.16.20.10

# Send all other queries to the host's usual DNS server
server=10.0.0.2

When you use a local forwarder:

• Point the host’s resolver at the forwarder (127.0.0.1), so that the Access Tier sends its queries there. How you do this depends on how the host manages DNS, such as systemd-resolved, NetworkManager, or a static /etc/resolv.conf.
• On hosts that run systemd-resolved, its stub resolver also listens on a loopback address. The listen-address and bind-interfaces lines above keep dnsmasq on 127.0.0.1 only, so that the two do not conflict on port 53.

• Confirm that each domain resolves through the forwarder, and then through the host’s resolver:

  dig +short @127.0.0.1 portal.corp.example.com
  dig +short portal.corp.example.com
  

• Restart the Access Tier so that it uses the new DNS configuration:

  sudo systemctl restart netagent
  

Verify from an end-user device

Connect to a Service Tunnel that routes traffic through the Access Tier, and then resolve a name in each private domain:

nslookup portal.corp.example.com
nslookup rds.lab.example.local

Each name resolves to its private IP address.