parliament32 2 days ago

> Your DNS responses should not change based on what network you are connected to.

GeoDNS and similar are very broadly used by services you definitely use every day. Your DNS responses change all the time depending on what network you're connecting from.

Further: why would I want my private hosts to be resolvable outside my networks?

Of course DNS responses should change depending on what network you're on.

1
kccqzy 2 days ago

> but if you're inside our network perimeter and you look up their name, you get a private IP address and you have to use this IP address to talk to them

In the linked article using the wrong DNS results in inaccessibility. GeoDNS is merely a performance concern. Big difference.

> why would I want my private hosts

Inaccessibility is different. We are talking about accessible hosts requiring different IP addresses to be accessed in different networks.

dwattttt 2 days ago

If you have two interfaces connected to two separate networks, you can absolutely have another host connected to the same two networks. That host will have a different IP for each of their interfaces, you could reach it on either, and DNS on each network should resolve to the IP it's reachable on on that network.

parliament32 1 day ago

Correct, and this is by design. Keeping in mind "hairpin"-style connections often don't work, also by design (leaving a network then hairpinning back into the same network).

Let's say you have an internal employee portal. Accessing it from somewhere internal goes to an address in private space, while accessing it from home gives you the globally routable address. The external route might have more firewalls / WAFs / IPSes etc in the way. There's no other way you could possibly achieve this than by serving a different IP for each of the two networks, and you can do that through DNS, by having an internal resolver and an external resolver.

> but you could just have two different fqdns

Good luck training your employees to use two different URLs depending on what network they originate from.