2

I'm currently attempting to track down a problem with a Websense Web Filter breaking SSL connections for sites in a conditional forward. To do this, I need to know exactly how a conditional forward works.

How its been explained so far is that a request is made of my company's DNS from a host within the private network. The company's DNS does not know the IP of address but knows what DNS server does, it then queries Company B's DNS server for their internal IP for this site. When Company B's DNS responds, our DNS relays the information and a VPN session is established at the firewall to this site.

How its happening for SSL/HTTPS requests is that, the host is making that same request but instead we are receiving a "The DNS server could not resolve host" error message back. When the station or address is removed from WCCP via access-lists on the firewall, the host is then able to access the site as normal.

So TL;DR, I need to understand how conditional forwarding works to connect hosts via VPN to another's private network.

Improve this question

1 Answer 1

Reset to default
1
+50

A conditional forward is SPECIFIC to a domain being queried at the end of the day. Let's model this:

YOUR COMPANY
yourco.com
finance.yourco.com
mrkting.yourco.com

Internet
yahoo.com
google.com
blogger.com

Internet.Misc
login.yahoo.com

We have your company three websites, and a specific Yahoo site. When a machine makes a query from say your network:

john.yourco.com --> whois finance.yourco.com --> your DNS server

It's best this query be handled internally by your DNS servers. This minimizes any kind of leakage. You wouldn't want anyone on the outside to be able to even know about the internal design of your network, e.g.: prototypes-of-new-revunue-generation.yourco.com

Now, when someone in your network visits say Google, Blogger, Yahoo, initially they'll query your DNS server:

john.yourco.com --> whois google.com --> your DNS server

In the event your DNS server doesn't see it right away, it will make this query to the root servers. There is no mechanism to control what/who sees what coming from you. Now imagine the following:

john-remote.house.com --> find: prototypes-of-new-revunue-generation.yourco.com --> DNS

You would not want this traversing through the Internet so you shove it into a conditional forward. Pseudocode:

if usersearch == specific_to_me
    then
       send him to this server ALL THE TIME
    else
       let him query root servers
fi

It can also reduce the amount of traffic coming in and out of your network. This coupled with the fact that, you can ensure no one has hijacked your DNS server to re-route, etc.

http://skibbz.com/how-forwarder-resolves-queries-between-internal-and-external-dns-server/ http://technet.microsoft.com/en-us/library/cc782142%28v=ws.10%29.aspx http://technet.microsoft.com/en-us/library/cc757172%28v=ws.10%29.aspx

Improve this answer
4
  • So when I'm making a web request, the origin is really making a whois request first of our DNS?
    – HAL
    Apr 16, 2014 at 14:02
  • 1
    It all depends on the hosts file, which DNS server is listed first. Say in your hosts or resolv.conf file, you have 8.8.8.8 listed as your first DNS server, your queries will go to Google followed by whatever you have listed as your primary. When you configure conditional forwarding, you are programming specifics: "This should be queried here, etc"
    – munkeyoto
    Apr 16, 2014 at 14:23
  • Neat! In the case of a VPN is it safe to assume that the normal route for a conditional forward is....host requests whois: attinternalsite.com----> Company DNS if usersearch== attinternalsite.com send him to attdns(1.1.1.1)-----> Query attdns 1.1.1.1 -----> Reply to Host -----> Host sends packets to internal ATT address----> Firewall views destination, encapsulates the traffic?
    – HAL
    Apr 16, 2014 at 14:41
  • Yes. When one connects via Tunnels, its not uncommon for the tunneled interface to use DNS servers assigned by the tunneled side upon getting DHCP. When this occurs (tunnel connection) the tunnel prefers tunneled servers first, but once inside the destination, it ALSO helps to have DNS configured properly
    – munkeyoto
    Apr 16, 2014 at 14:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .