Thursday, October 24, 2019

One Linux DNS server + multiple VLANs = DNS resolution dice-roll

I'm having some trouble with a single server that is intended to handle DNS duties for multiple networks/VLANs. Each time I have a workstation ping the DNS server's FQDN, the DNS server doesn't consistently point the workstation to the correct IP address respective to the VLAN the workstation is on.

I'd appreciate it if someone could point me in the direction of what I should research in order to make this work. Days of Googleing have led me down false rabbit holes. What I'm trying to do seems like it should be a basic thing, but I know just enough about Linux to get myself into trouble.

A more verbose description of the situation is below.

Scenario and environment:

1 - I have a Univention 4.4 server (basically a fancy Debian distro) intended to serve as a domain controller and DNS server for each of our networks/VLANs. It is to be known on each by the FQDN of uni1.bz.mycompany.net.

2 - The server has a single NIC and three virtual interfaces, configured as follows:

  • 10.1.1.10 /16 [Physical Network]
  • 10.2.1.10 /16 [VLAN02]
  • 10.10.1.10 /16 [VLAN10]
  • 10.100.1.10 /16 [VLAN100]

3 - I have added DNS Reverse Lookup records accordingly, which point those respective IP addresses to uni1.bz.mycompany.net.

Problem:

Any workstation on any VLAN should be able to "ping uni1.bz.mycompany.net" and be resolved to the appropriate IP address (e.g. 10.2.1.10 for VLAN02, 10.10.1.10 for VLAN10, etc). That is not happening.

Instead, a run of "ping uni1.bz.mycompany.net" from a workstation will resolve randomly to any one of the server's four IP addresses, regardless of VLAN.

In other words (and for example), a workstation on VLAN02 that runs "ping uni1.bz.mycompany.net" will only have a one-in-four chance of being correctly directed to 10.2.1.10, and a three-in-four chance of being incorrectly directed to one of the other IP addresses (10.1.1.10, 10.10.1.10, or 10.100.1.10) instead, which naturally would be unreachable to that workstation.

Expectation:

The DNS server is expected to point workstations to the correct IP address respective to whatever VLAN the workstation is on. If the server receives a DNS lookup request from a workstation on VLAN2, it should respond with the appropriate VLAN2-specific address, etc.

Thank you!



No comments:

Post a Comment