● Covered by 1 source · 1 reportMedium impact
Implementing Split-Horizon DNS for Secure Internal Services
Key points
- Uses split-horizon DNS for internal services.
- Public domain allows CA-signed certificates.
- Requires WAF to filter VPN-originating traffic.
Introduction to Internal Services
Internal services are essential for businesses, particularly when they interface with both internal and external users. Using a VPN for access is common, but it raises security challenges regarding certificate management.
The Dilemma with Self-Signed Certificates
Using a private top-level domain like '.internal' necessitates self-signed certificates, which require every client to trust them. This is cumbersome as it involves misleading users to bypass TLS errors or configuring trust on each device.
Implementing Split-Horizon DNS
Opting for a public apex domain allows for a well-structured DNS setup. Split-horizon DNS architecture differentiates responses based on network connectivity, resolving to public IPs for external access while providing internal IPs for VPN clients. This enables the use of public CAs like Let's Encrypt, simplifying the certificate process.
Security Measures with a WAF
To ensure that only approved traffic reaches internal services, a Web Application Firewall (WAF) can be deployed. This layer secures access yet requires users to come from the VPN, further tightening internal service exposure.
Tools and Implementation Steps
The implementation proposes using NetBird for VPN services with DNS resolution, acme.sh for managing certificate issuance, and nginx as a reverse proxy with WAF capabilities. NetBird simplifies the customization of DNS zones, making the setup process more efficient.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub acmesh-official/acme.shReporting from
The article details the implementation of split-horizon DNS for internal services, emphasizing the benefits of using a public domain with CA-signed certificates over self-signed ones. This method simplifies certificate management and improves security for internal applications accessed via VPN.