Implementing Split-Horizon DNS for Secure Internal Services

Introduction to Internal Services

Internal services are essential for businesses, particularly when they interface with both internal and external users. Using a VPN for access is common, but it raises security challenges regarding certificate management.

The Dilemma with Self-Signed Certificates

Using a private top-level domain like '.internal' necessitates self-signed certificates, which require every client to trust them. This is cumbersome as it involves misleading users to bypass TLS errors or configuring trust on each device.

Implementing Split-Horizon DNS

Opting for a public apex domain allows for a well-structured DNS setup. Split-horizon DNS architecture differentiates responses based on network connectivity, resolving to public IPs for external access while providing internal IPs for VPN clients. This enables the use of public CAs like Let's Encrypt, simplifying the certificate process.

Security Measures with a WAF

To ensure that only approved traffic reaches internal services, a Web Application Firewall (WAF) can be deployed. This layer secures access yet requires users to come from the VPN, further tightening internal service exposure.

Tools and Implementation Steps

The implementation proposes using NetBird for VPN services with DNS resolution, acme.sh for managing certificate issuance, and nginx as a reverse proxy with WAF capabilities. NetBird simplifies the customization of DNS zones, making the setup process more efficient.