DNS Config Problem: mydomain.org @ LAN + www.mydomain.org @ Internet

[El Bürger]

Hi Zentyaleros,

I'm trying to set up Zentyal 2.0-4 as a Gateway in the office of a small business (with other Zentyal modules installed, which should not matter here).

I believe, this case could potentially be representative for many small businesses and I'm therefore looking forward to developing a HowTo (this first post, until now, only describes the problem, but unfortunatly not the solution).

DNS configuration seems to be challenging for most non-IT-experts (like me), which is why this subjects seems to come up in this forum over and over again.

I found a good post here:
http://forum.zentyal.org/index.php/topic,1192.msg4671.html#msg4671
... but this does not completely reflect the following reality:

I'm in a small office, not a data center - meaning that my internet connection is provided by my ISP through a dynamic IP, not a static IP. I may set up dynDNS to reach my server from the outside, but hosting my public website www.mydomain.org is not an option on our local server. The good thing: we don't need/ want to host the public website, because -probably just like most small businesses- we already have one up and running (on a server in a data center).

This includes another interesting reality:
I believe that most small businesses, who are starting to look into using Zentyal, are not starting up their businesses from scratch, but already use some sort of IT - potentially even with a server and some services running in their offices and are considering Zentyal for the convenience of easier server management.

Also:
I would like to use my routers "only" as switches and WLAN access points and use Zentyal for the routing. I don't know, how relevant this is, but it might be worth mentioning.

This is what I would like to accomplish:

I would like to use mydomain.org @ my LAN, but have subdomains, such as www.mydomain.org someplace else @ the Internet.


HowTo set up DNS with Zentyal?

In my case, I'm currently running Ubuntu Server 8.04 @ 192.168.0.222 and Zentyal is @ 192.168.0.223.

On my "old" server, one part of DNS is configuered at /etc/bind/zones/mydomain.org.db like this:

$ttl 60
@                    IN      SOA     myoldserver  root.myoldserver (
                                     2008010403
                                     10800
                                     3600
                                     432000
                                     38400   )
@                    IN      NS      myoldserver
router1              IN      A       192.168.0.1
router2              IN      A       192.168.0.2
myoldserver          IN      A       192.168.0.222
*.myoldserver        IN      A       192.168.0.222
client1              IN      A       192.168.0.201
client2              IN      A       192.168.0.202
client3              IN      A       192.168.0.203
www                  IN      NS      ns1.first-ns.de.
www                  IN      NS      robotns2.second-ns.de.



Here is my config on Zentyal:

-> Core -> Network -> DNS

Domain Name Server Resolver List
127.0.0.1
208.67.222.222
208.67.220.220

Search Domain
mydomain.org

-> Infrastructure -> DNS

List of Domains
mydomain.org - IP: 192.168.0.223 - Dynamic: yes
www.mydomain.org - IP: -none- - Dynamic: no

for mydomain.org:

Hostnames:
client1: 192.168.0.201
client2: 192.168.0.202
client3: 192.168.0.203
router1: 192.168.0.1
router2: 192.168.0.2
ns: 192.168.0.223; alias: server

Mail Exchangers:
none (yet)

Name Servers:
ns

for www.mydomain.org:

Hostnames:
ns: 127.0.0.1

Mail Exchangers:
none (yet)

Name Servers:
ns
ns1.first-ns.de
robotns2.second-ns.de


The results at his point:


1)
me@zentyal:~$ dig mydomain.org

; <<>> DiG 9.7.0-P1 <<>> mydomain.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 9361
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;mydomain.org.                  IN      A

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Aug 22 13:17:18 2011
;; MSG SIZE  rcvd: 30


2)
me@zentyal:~$ dig client1.mydomain.org

; <<>> DiG 9.7.0-P1 <<>> client1.mydomain.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 57298
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;client1.mydomain.org.                IN      A

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Aug 22 13:21:35 2011
;; MSG SIZE  rcvd: 40


3)
me@zentyal:~$ dig www.mydomain.org

; <<>> DiG 9.7.0-P1 <<>> www.mydomain.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31780
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;www.mydomain.org.              IN      A

;; AUTHORITY SECTION:
www.mydomain.org.       86400   IN      SOA     ns.www.mydomain.org. hostmaster.www.mydomain.org. 2011082210 28800 7200 2419200 86400

;; Query time: 31 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Aug 22 13:23:05 2011
;; MSG SIZE  rcvd: 84


Means: DNS doesn't resolve as I would like it to.

OK, let's try ping:

1)
me@zentyal:~$ ping mydomain.org
PING mydomain.org (11.22.33.44) 56(84) bytes of data.
64 bytes from remote.server.com (11.22.33.44): icmp_seq=1 ttl=47 time=290 ms
64 bytes from remote.server.com (11.22.33.44): icmp_seq=2 ttl=47 time=287 ms
64 bytes from remote.server.com (11.22.33.44): icmp_seq=3 ttl=48 time=288 ms
^C
--- mydomain.org ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2000ms
rtt min/avg/max/mdev = 287.611/288.913/290.975/1.599 ms

2)
me@zentyal:~$ ping client1.mydomain.org
PING client1.mydomain.org (11.22.33.44) 56(84) bytes of data.
64 bytes from remote.server.com (11.22.33.44): icmp_seq=1 ttl=47 time=290 ms
64 bytes from remote.server.com (11.22.33.44): icmp_seq=2 ttl=47 time=287 ms
64 bytes from remote.server.com (11.22.33.44): icmp_seq=3 ttl=48 time=288 ms
^C
--- client1.mydomain.org ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 286.871/289.089/292.293/2.320 ms

3)
me@zentyal:~$ ping www.mydomain.org
PING www.mydomain.org.mydomain.org (11.22.33.44) 56(84) bytes of data.
64 bytes from remote.server.com (11.22.33.44): icmp_seq=1 ttl=47 time=290 ms
64 bytes from remote.server.com (11.22.33.44): icmp_seq=2 ttl=47 time=287 ms
64 bytes from remote.server.com (11.22.33.44): icmp_seq=3 ttl=48 time=288 ms
^C
--- www.mydomain.org.mydomain.org ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2000ms
rtt min/avg/max/mdev = 289.315/290.187/290.686/0.759 ms

Notes:

a)
www.mydomain.org.mydomain.org

b)
The IP of the remote serve is actually resolved correctly, to where www.mydomain.com is hosted (substituted here with 11.22.33.44).

c)
Other domains are resolved correctly. As a matter of fact, I'm writing this post from client1@mydomain.org.

d)
Yesterday, names in the LAN were resolved correctly, but www.mydomain.org wasn't. I've been playing with this configs for quite a while now and unfortunatly I can't recall, what I changed before it stopped working.

e)
Where are ns.www.mydomain.org and hostmaster.www.mydomain.org coming from?


... and at the end: 2 questions:

What do we need to include and/ or explaine better, so that all this makes sense to more non-IT-pros?

How do I solve my configuration problem?

Saludos,

El Bürger

[christian]

Wow, at least there is a lot of information and detail here!!!

May I summarize my understanding stating that you would like:
- resolve server1.mydomain.com as server on you LAN, for internal users only (e.g. on 192.168.1.0/24 subnet)
- resolve server2.mydomain.com as server on internet for both internal and external users. Internal users will rely on Zentyal HTTP proxy to access this server.

Is it what you mean?

[El Bürger]

Hi Christian,

First: thanks for reading all that - I know, it turned out a bit long... ;-) ... and thanks for your quick reply!

Yes. That's pretty much it.

- resolve server1.mydomain.com as server on you LAN, for internal users only (e.g. on 192.168.1.0/24 subnet)

That would be -let's say- zentyal.mydomain.org in my example above.

- resolve server2.mydomain.com as server on internet for both internal and external users. Internal users will rely on Zentyal HTTP proxy to access this server.

That would be -let's say-  remote.server.com (e.g. www.mydomain.org) in my example above.

I'm just starting to understand how a Proxy works (using it for the first time), so maybe the problem is there?

[christian]

I don't think there is anything related to proxy at this stage but:
- why would you go for Zentyal like product if at the end you have to drill-down into DNS complex configuration requiring to edit manually config files?
- did you try the easy straight forward way using Zentyal GUI?
- do not use "ping" to resolve DNS potential issues but rather nslookup.

Now I need to read it all again at the light of your explanation.
Not understanding the very detail of problem you may face, implementation looks easy, GUI only 

[El Bürger]

- why would you go for Zentyal like product if at the end you have to drill-down into DNS complex configuration requiring to edit manually config files?

Well, I hope Zentyal will be easier in the long run - sort of everything strait forward: click, click, number here, value there, click, safe, done... I only set up a server maybe once every 2 years and had very good help so far, but this time it's going to be only me (with community help). The config I posted above from the "old server" was also only possible with a lot of help. Although I do understand what it means and does, it's always more difficult to apply things on your own. E.g.: it really took me a long time to understand, what the "hostnames" in the Zentyal GUI are for...

- did you try the easy straight forward way using Zentyal GUI?

Oh yes. On the Zentyal machine, Zentyal GUI only (so far). I definitly would like to do as much as possible through the GUI (but I'm not affraid of the shell either and understand that I shouldn't config the same service through the GUI _and_ manually).

- do not use "ping" to resolve DNS potential issues but rather nslookup.

Ok. That's why I tried dig in the first place, but you're right nslookup is also interesting.

... implementation looks easy, GUI only  ...

I know! That's why I finally posted my problem here after a few days of playing with it. There a tons of other things to set up, like mail etc., but without DNS working...

[christian]

OK, let me try to provide, if not yet complete answer, at least some track for investigation.

I would like first clear up some misunderstanding that I feel worth to be understood:

• www.mydomain.com is NOT a subdomain. You domain is "mydomain.com" and until you decide to split if, there is no subdomain but records pointing to hosts and/or services. This has to be clarified for further discussion.
• subdomain could be a solution 
• your domain does already exist on Internet with some DNS managing it. This is what permits today access to www.mydomain.com. If we limit our debate to web based services, this should not be an issue. If we try later to extend Zentyal to mail, we may face some problems in case you can't manage this external DNS. However I'm not comfortable with your general statement that is to use routers as switch only. This means that services will be relayed by Zentyal box but you do have to name these services and define what you want to achieve here.

Now for internal side:
- deploy Zentyal using "mydomain.com" as domain name. The real question here is "which version to be deployed?". This may have an impact (later in our deployment when you will understand more about DNS aspect) because Zentyal 2.2 offers capability to forward DNS request (this doesn't exist out of the box with 2.0). so depending on your timeline, either you deploy 2.2RC1, make tests and wait for 2.2 to be released or you want to go live asap and deploy 2.0 with some tricks.
- do not care yet about Zentyal server name. Once Zentyal installed, up and running, you can define an alias for this server. Be sure to properly define "external" DNS in the "network/DNS" section so that Zentyal can resolve external names, including your "www.mydomain.com"
- once Zentyal is deployed, you will notice that Zentyal server can be access from Intranet using it's IP address. Then the point to be understood here is that tricky part is client side, not server side. your clients have to be aware of "Zentyal in the middle", meaning:
- use Zentyal as default gateway
- use Zentyal as DNS (in case you don't have other on you LAN)
- use Zentyal as HTTP proxy

All above can be done using DHCP setting.

I can't re-explain everything within this mail but I hope you got the idea.
The best way to achieve it is first to read documentation at http://doc.zentyal.org/en/.

[ichat]

here 's my  2cts  ...

first of all..  why do you want/need to resolve   anydomain.com  to a  local lan ... 
why not   any.domain.com.local    (adding the .local  - with take your dns out of the internet skope making it a completely different  tld  and thus  no interference with your current domain settings)

for mail intergration your could easily  add  a bunch of records  (a,  mx, ptr)   for   mail.yourdomain.com    to your zentyal server  while  retaining  your   dns1.domain.com  and  dns2.domain.com  with your current isp / registrar.

 you could even  engage with  zone transfers for   newyork.domain.com   (www.newyork.domain.com / mail.newyork.domain.com    joe@newyork.domain.com)     or amsterdam.domain.com    (lisa@amsterdam.domain.com )

 

btw  @ cristion   www.   IS a subdomain ... it always is,    its default on must webserver-hosting enabled servers, 
but without proper  sub-domain records in your dns    it does not exist at all...     to be more precise,    http://www.domain.com  and    http://domain.com  are actually  not even the same thing...  (and need aditional configuration to  be in sync.    yet this is a common used 'hack'  for avarage joe to not get lost .... )

[christian]

first of all..  why do you want/need to resolve   anydomain.com  to a  local lan ... 
why not   any.domain.com.local    (adding the .local  - with take your dns out of the internet skope making it a completely different  tld  and thus  no interference with your current domain settings)

This is the usual Microsoft's way of solving this "issue". It works too 
The idea here is to avoid split DNS design... for people not understanding how DNS works 

for mail intergration your could easily  add  a bunch of records  (a,  mx, ptr)   for   mail.yourdomain.com    to your zentyal server  while  retaining  your   dns1.domain.com  and  dns2.domain.com  with your current isp / registrar.

and when you use your mail client outside your LAN, you connect to another SMTP server...? is it what you mean?
Such problem doesn't exist with Exchange  neither if you only use webmail but having one single mail client configuration working for both internal and external connection because you have one single domain with split DNS is another very convenient option 
 

btw  @ cristion   www.   IS a subdomain ... it always is,    its default on must webserver-hosting enabled servers, 
but without proper  sub-domain records in your dns    it does not exist at all...     to be more precise,    http://www.domain.com  and    http://domain.com  are actually  not even the same thing...  (and need aditional configuration to  be in sync.    yet this is a common used 'hack'  for avarage joe to not get lost .... )

You're right but to me this is a misconception.
"www", because pointing to one server at one IP address, should be CNAME record pointing to "A" record.
In case you want or need to manage www.mydomain.com subdomain, it means that you expect to managed "A" records and "CNAME" belonging to this zone otherwise it just doesn't make any sense. Or at least I don't understand the goal of such zone if there is no content inside. Where is the hack here? Hacking what?

[ichat]

This is the usual Microsoft's way of solving this "issue". It works too 
The idea here is to avoid split DNS design... for people not understanding how DNS works 

completely agree,  but than again, how is that a bad thing...    if allready this is a problem  - why even bother with a dns split zone...

and when you use your mail client outside your LAN, you connect to another SMTP server...?

no you connect to mail.yoursite.com  - pointing to   %your-external-ip%   so you dont add any local ip's to it you just cash it with your resolver.   (always using your external ip rather than internal ip...   

i mean if you already have an external dns service running for your  (probably even redundant and fail safe) why bother transfering your lookup zone to your zentyal machine ...

In case you want or need to manage www.mydomain.com subdomain, it means that you expect to managed "A" records and "CNAME" belonging to this zone otherwise it just doesn't make any sense. Or at least I don't understand the goal of such zone if there is no content inside. Where is the hack here? Hacking what?

i mean that there is a diferent in www versus  non www...   if you want to maanaged it i requires settings if you want www.domain  to be the same as   .domain    that part requres wildcards and crap like that...   its not a real hack - but it sure as clear vor avarage-joe...   (in lame terms i mean)...

[christian]

i mean that there is a diferent in www versus  non www...   if you want to maanaged it i requires settings if you want www.domain  to be the same as   .domain    that part requres wildcards and crap like that...   its not a real hack - but it sure as clear vor avarage-joe...   (in lame terms i mean)...

I definitely don't understand what you wrote    Sorry 

[El Bürger]

Hi,

Thanks for all your detailed input!

I'm still at the same point, because I've been waiting with further configs to see what all you have to say...

Isn't *.local "reserved" for or "preferred to be used with "zeroconf" or something similar? I'm not exactly sure, but I believe, I read something about this and therefore thought I shouldn't use it.

On the internet, the server, which hosts my domain is up and running. This server is not managed by me, but I could ask for changes in the DNS files, if needed and appropried. www.mydomain.com is resolved correctly and available to the public. Also all my mails for this domain go through this server, from where I download them using POP to my local server and distribute them in the LAN via IMAP. Now, I would like to reconstruct this same scenario using Zentyal. Maybe that helps understanding, what I'm trying to do?

It might be worth trying Zentyal 2.2rc. Could I export/ import the configs from 2.0 to 2.2 and start from there?

I'll now start looking more into the detail of what you wrote. Thanks again!

[christian]

Ah ah!!! it's evolving and not in right direction for clear shared understanding 

Based on what you described previously, I made the assumption you were asking about web servers (i.e. www.yourdomain.com) but now you come back with mail related question (except if I misunderstood at the very beginning)

1 - Mail relies on DNS too but is using different and specific DNS records (like MX).
2 - There is definitely NOTHING you can do on Internet side unless you change public MX record to point to your own SMTP server (running on Zentyal). OK, you may have both with different weights but it's far beyond what we can discuss for the time being.
3 - Given what I think you understand of this aspect, I would strongly suggest you don't change anything unless you have performed internal full test with "in detailed" understanding of how it works. Risk is just that you may not receive mail any more...
4 - you will be disappointed because what I've to say doesn't match your expectation:  do not expect me to share here some screen copy of DNS db files    Not because I don't want to share but because Zentyal is, at least the way I feel it, just trying to present things in a way avoiding to edit such files. If your goal is to work at config file level using vi, then do not work with Zentyal. You will have less problems with Ubuntu server, Postfix, Dovecot plus some clam and spamassassin 

My $0.02

[El Bürger]

I have a general understanding of how DNS works, means: I do understand the entries in the config files: MX, CNAME, IN, NS, SOA, A and even AAAA (the later only mentioning, 'cause it hasen't come up yet, which at the same time as of right now, I understand, is not necessary). I've done my "homework" as so to say. BUT since I want to use Zentyal, the big question here (for now) is what's wrong in the my Zentyal setting. This is why I posted in the first place an example of what I want to do and how this looks like at this momtent in a working environment - with both: www.mydomain.com up and running and my local network also being called mydomain.com. So again, the big one is about howto use the Zentyal GUI here. I hope this help making it a bit more clear...

I'm seriously thinking about installing Ubuntu Server and go from there, but I'm more curious about Zentyal right now... ;-) I simply don't want to believe that my scenario is that complicated. Maybe it is, though?

I should add that I did read the docu. - beginning to end actually - literally every word, cross checking with other sources on the internet, if I didn't understand anything or when I thought the docu. sort of presumes a certain base of knowledge, which I didn't have here and there (except some parts of load balancing, 'cause this is not interesting for me, 'cause I only have one i-net connection).

[christian]

No, scenario is not complex at all. This is what I've at home i.e. meaning public DNS and internal DNS having MX pointing to Zentyal SMTP server.
It's so simple that it doesn't deserve any specific config.

If you understand basic DNs and basic mail stuff, I don't understand what your problem is.
- set up Zentyal with DNS and mail service
- for the time being do not change external MX (record pointing to your mail provider)
- setup internal domain to use Zentyal MX
- once you have ensured SMTP configuration works, then you can change public DNS to have first MX (lower weight) pointing to your Zentyal SMTP (of course you have fixed IP address) and second MX pointing to you current mail provider (as backup, just in case  )
- if load balancing is an issue for you, you can set up MX with same weight.

Please explain again what you mean with www.mydomain.com
Is it a web site or a subdomain? any link with mail related debate?

[El Bürger]

Thanks Christian for all the time you put into this. I really appreciate that!

I'll look into this tomorrow! It's my birthday and time to live offline! ;-)