[Dnsmasq-discuss] Split DNS guidance needed

[Jeff Boyce]

Greetings –

Issue:

I am hosting an instance of OwnCloud on a company server located within
our local lan.Internal clients access it by name using
“cloud.local.lan”.External clients access it by name using
“cloud.companydomain.com”.One of the features of OwnCloud is being able
to provide direct links to documents within the OwnCloud server to
others outside of our company.OwnCloud provides internal clients with a
link referencing “cloud.local.lan”; however, if this link is provided to
an external client it will not work because it is referencing our
internal lan name.Our internal staff can not use our external domain
name (cloud.companydomain.com) to access the OwnCloud
server.(Specifically, they receive the pfSense 501 page referencing
Potential DNS Rebind attack detected.I initially took this issue to the
pfSense forum, and have been advised that setting up a Split DNS
configuration would solve my issue.)

My Objective:

I would like to have our internal clients use the external domain name
(cloud.companydomain.com) to access our OwnCloud instance.Then the
document links that OwnCloud generates would work for anyone we provide
them to outside of our company.

My network configuration:

Internet ---> pfSense ---> Switch

|

---> DNSmasq box

|

---> OwnCloud box

pfSense box (192.168.112.11)

External IP xx.yy.zz.18

Network gateway and firewall

1:1 NAT providing 4 public IPs to internal servers

Uses ISP DNS server aa.bb.cc.1

ISP DNS server aa.bb.cc.2

Google DNS server 8.8.8.8

DNSmasq box (192.168.112.51)

DNS and DHCP server for lan

Gives LAN clients

DNS server 192.168.112.51

Default Gateway 192.168.112.11

OwnCloud box (192.168.112.53)

External IP xx.yy.zz.21

companydomain.com

Physical box hosted by outside provider

zone file for companydomain.com

If Split DNS is what I need, then I am assuming that I would have to
implement it on my DNSmasq server.I am logically thinking that when an
internal client puts cloud.companydomain.com in a browser, there is a
way that it can be resolved internally from the DNSmasq box to return
the OwnCloud login page, rather than needing to go out through the
gateway to be resolved (which results in the pfSense rebinding attack
detection).

I have searched the mail archives for some guidance and usually end up
back at this thread
https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg09705.html.I
am unable to implement this solution, as some features are not in my
version of DNSmasq (specifically host-record).So I am still uncertain
how to implement something that reaches my goal.My DNSmasq box is CentOS
6.7 running DNSmasq 2.48-14.el6.The host-record feature is only
available since 2.64.

I am looking for a simple description for implementing something in
DNSmasq that addresses my objective listed above, so pointers to other
how-to’s are appreciated.

I am not sure what additional information anyone might need to assist me
with this issue, but let me know if anything else is needed.Thanks.

Jeff