Welcome to ITFreeTraining video on Split-Brain DNS. Split-Brain DNS is when you use the same
DNS name for your internet network as your external clients rather than using a different
DNS name. For example, it is common practice to use an external address ending in dot com
for external clients and dot local for internal clients. This video looks at how you would
set a network using the same DNS for internal and external called Split-Brain and the problems
you may have if you use this approach. To start to understand split-brain DNS and
why you want to use it, first consider that you have a web server on the network. The
web server contains the company web site, in this case ITFreeTraining.com.
In order for an external user to access the web page, they will need to contact a DNS
server to obtain the IP address of the web server. The web server and DNS server are
most likely to be located on a perimeter or DMZ network with a firewall separating them
from the internet. The problem occurs when you have an internal
client that needs to access the web server as well. Notice that the client has the same
domain name as the web server. In order to find the web server, the client will contact
a DNS server, most likely it will contact a DNS server on its local network.
It should be pointed out here that both the DNS servers hold the same DNS zone that is
they both hold the ITFreeTraining.com zone. This network is quite functional and this
would seem like a good approach but there is one problem with this approach.
The problem is that all the DNS records on your network are on a DNS server that is accessible
on the internet. This includes records that are not required by internet users like the
DNS records that are used by Active Directory. What this potentially means is that a hacker
could connect to the DNS server and obtain all the DNS records on your network. This
information gives the hacker a good understanding of how many clients you have on the network
and what services are in use. This process is called footprinting the network. All though
this is not essentially an attack of the network, hackers will use this approach to obtain information
about your network to work out how they can attack it. If you can protect your internal
DNS records from being accessed, you are helping to protect your network from attack.
Before I look at how Split Brain works, I will first look at the whole Brain approach.
The Whole Brain approach is when you use different DNS names for the internal and external networks.
The reason I look at this method first is that it is easier to setup and has less problems
than split brain. The point to remember is that Split-Brain and Whole Brain are two approaches
to solve the one problem. If you asked 10 IT people to agree on which approach to use,
all 10 would never be able to agree and it comes down to the choice of the individual
administrator which to use. In our videos, we use the whole brain approach as it is easier
to setup and easier to understand. In this example, the internal network uses
the DNS name ITFreeTraining.local and the external uses ITFreeTraining.com. If an attacker
was to gain access to the DNS records on the external DNS server, in this case they would
only be able to access the DNS records that were publically available anyway. The internal
DNS records would still be safe on the internal DNS server and not accessible on the internet.
In a lot of cases, the company will configure the internal DNS server to forward unresolved
DNS requests to a DNS server on a perimeter network. This not only includes external domain
names like Microsoft.com or Google.com but also requests like ITFreeTraining.com. Using
this method, any internal client can resolve the address for any server on the perimeter
network or DMZ networks. The second advantage of this method is that the internal DNS server
does not need to connect to the internet directly. This provides additional security for the
internal DNS servers. Split-Brain DNS uses a different approach.
It uses two sets of DNS records for the same DNS domain name. As you can see in this example,
each DNS server has its own independent set of DNS records. They may be for the same DNS
name, but the DNS servers effectively works independently of each other.
This once again means that if an attacker were to gain access to the DNS records, they
could only access the records on the public DNS server. This would only give the attacker
an indication of what services the company has made available to the public and would
not tell them what services are available on the internal network. You can see that
using a Split-Brain reduces the complexity for the user as they are now only dealing
with one DNS name but we will soon see how it can increase the complexity for the administrator.
The main problems you will see is determining which resources the user wants and directing
them to the right one. A lot of companies have an internal internet web server called
an Intranet server. To make things simple it is easy for the administrator to make the
internal web server www like the external web server. This works quite well as the internal
users will be directed to the Intranet web server and anyone accessing the network from
external will be directed to the external web server. The problem occurs when a user
on the internal network wants to access the public web server. There is no way of achieving
this if you use the same name on the internal and external network.
The next problem is if you have a mobile user. If they are not connected to the company network
by, say a VPN, they will be directed like any other public user to the external web
page. Once they connect up to the company using a VPN connection they will be directed
to the Intranet web server. This may not seem like a big problem but can
cause the user a lot of confusing when they are directed to the wrong resource and don't
know why. A VPN user can only be directed to one DNS server that will return its results
based on the DNS records it has. If you are using DirectAccess, it is possible with direct
access to configure rules to ensure the remote user is directed to the correct location.
The remote user is directed based on rules configured for Direct Access rather than what
records are on the DNS Server they are using. You can see that using split-brain can start
to become complex if you have the same names used on two networks. You need to start considering,
who the user is and where they are connecting from in order to direct them to the right
place. In one company that I did some work for, they
had a secure network which was in its own domain. The decision was made to combine the
secure network with the internal network to make it one large domain. This makes sense
since with Windows Server 2008 you can have more than one password policy which was
part of the reason the networks were split up originally.
The next problem was that the DNS domain names were now combined as well and certain resources
for clients in the secure network were not being directed correctly. It does not sound
that complex, but when you have large companies with VPN connections to other companies in
other parts of the world and external clients connecting to the network, name resolution
can start to become complex. Once you start adding to the complexity of having different
resources in different networks called the same name but should be resolved differently
depending on how the client is connecting or where they are connecting from this can
make it even more complex. In this scenario the problem was fixed by creating a host file
on each of the secure computers which would override the settings from the DNS server
to ensure the client was directed to the correct location. Not the best solution but it did
work. You can see that Split-Brain DNS does reduce the complexity for the user in that
they only have to use the one address to access resources regardless of where they are or
how they connect to the network, but may add additional problems for the administrator
later on. The last point that I want to cover when deciding
which approach to use is non registrable domain names. As shown, test, example, invalid and
LocalHost are not registerable. It will never be possible for any address that ends in any
of these to be registered. If you use a domain name that is only to be
used on the local network and you never want it to be to resolved on the internet, you
should use a domain name that ends with one of these. Using an internal domain name that
cannot be resolved on the internet helps protect your internal network.
You may have noticed that domain names ending in local are not listed here. Local was never
a domain name that was listed as a domain name that could not be registered. Even so,
it became very popular with companies to use even though potentially one day it could be
registered. If you are using a local address, you will
be happy to hear that local addresses are not Registrable under gLTD. What is gLTD?
This stands for Generic Top Level Domain. Generic Top Level Domains is a DNS feature
that will become available in 2013 that allows new top level domain names to be registered.
For example, new top level domains like Apple, XBox and food have been registered only to
mention 3 of 100's that have been registered already. These essentially means that if someone
attempted to register the "local" top level domain name, their application would be declined.
This means that if you used the dot local at the end of your domain name, you can be
assured that it cannot be resolved or registered by an internet DNS server which helps protect
your company. Well I hope you have enjoyed this video from
ITFreeTraining and have found it informative. For more free videos please feel free to visit
our web page or YouTube channel. Thanks for watching and see you next time.