Real-world Problem: Why Do You Need DNS Split-Horizon?
Have you ever been sitting right in the office but accessing the internal Mail Server or ERP is as slow as a snail? After 6 months of operating the system, I discovered a basic mistake: The server is placed in the LAN (IP 192.168.1.50) but the DNS only points to the Public IP (1.2.3.4), a common issue when IP infrastructure management is handled manually.
When that happens, packets from your machine have to travel up to the Firewall, perform Hairpin NAT, and then turn back to the Server. This process increases latency from under 1ms to 20-30ms. Even worse, if the Firewall is overloaded, the connection for colleagues in the company will be unstable even if the local network is fine.
The solution is DNS Split-Horizon (also known as Split-Brain). Simply put: The server looks at the requester’s IP to provide an answer. If it’s a machine in the LAN, it gives the internal IP. If it’s a guest from the Internet, it gives the Public IP. Everything happens completely automatically.
Core Concepts: ACL and View in BIND9
To implement this on Linux, you need to master two tools:
- ACL (Access Control List): Used to classify IP groups. For example: The “VIP” group is the LAN network, and the rest is the “Guest” group.
- View: This is the processing brain. It allows BIND9 to display different zone files depending on which ACL the client belongs to.
Pro tip: When you need to calculate complex IP ranges (Subnets) to include in an ACL, I often use IP Subnet Calculator. This tool helps you avoid CIDR typing errors that cause DNS to block the wrong users.
Hands-on: Configuring DNS Split-Horizon
I will perform this on Ubuntu Server. If you use CentOS or Debian, the logic remains exactly the same; just pay attention to the configuration file paths. You can also explore CoreDNS on Linux as a modern alternative for microservices.
Step 1: Install BIND9
sudo apt update && sudo apt install bind9 bind9utils bind9-doc -yStep 2: Define ACL for the internal network
Open the named.conf.options file to declare trusted IP ranges:
sudo nano /etc/bind/named.conf.optionsAdd the following code snippet to the very beginning of the file:
acl "trusted" {
127.0.0.0/8;
192.168.1.0/24; # Your office IP range
};Step 3: Setup Views (The most important step)
Normally, you declare zones directly. But with Split-Horizon, every zone must be wrapped in a view block. This is a more advanced configuration than configuring NAT64 and DNS64 on Linux for IPv6 compatibility.
Important Note: Once you use views, BIND9 requires 100% of zones (including default zones like localhost) to be inside a view. If any are left out, the service will report an error and fail to start.
Edit the /etc/bind/named.conf.local file:
# View for internal LAN users
view "internal" {
match-clients { "trusted"; };
recursion yes;
include "/etc/bind/named.conf.default-zones";
zone "itfromzero.com" {
type master;
file "/etc/bind/db.itfromzero.com.internal";
};
};
# View for external Internet guests
view "external" {
match-clients { any; };
recursion no; # Disable to prevent DNS Amplification attacks
zone "itfromzero.com" {
type master;
file "/etc/bind/db.itfromzero.com.external";
};
};Step 4: Create data for each View
We need two separate database files for the same domain name.
1. Internal zone file (Pointing to LAN IP 192.168.1.50):
sudo cp /etc/bind/db.local /etc/bind/db.itfromzero.com.internal
sudo nano /etc/bind/db.itfromzero.com.internalConfigure the A record for ERP to point to the internal IP.
2. External zone file (Pointing to Public IP 1.2.3.4):
sudo cp /etc/bind/db.local /etc/bind/db.itfromzero.com.external
sudo nano /etc/bind/db.itfromzero.com.externalHere, the A record will point to the Public IP so that outsiders can access it through the Firewall.
Step 5: Testing and Operations
Don’t rush to restart the service immediately. Check the syntax first to avoid disrupting the system:
sudo named-checkconf
sudo systemctl restart bind9Real-world Testing: Is it actually effective?
Use the dig command to confirm the results. You can also use modern tools like doggo for a more visual output. From a computer in the LAN, type:
dig erp.itfromzero.comIf the result returns 192.168.1.50, you have succeeded. To test the external direction, you can use your phone to provide a 4G hotspot for your laptop and then run the command again. This time, the result must be the Public IP 1.2.3.4.
Hard-learned Lessons from Operations
Once Split-Horizon is deployed, application response speed will be lightning-fast. However, there is a trap: When adding a new subdomain, you must update both zone files.
I once had a painful experience when I added a record for a partner in the internal file but forgot the external file. As a result, it worked perfectly when I tested it in the office, but the client called to complain because they couldn’t access the website. Always cross-check both views whenever you change the configuration.
Finally, never leave recursion yes in the external view. Otherwise, your server will soon become a tool for hackers to perform DNS Amplification DDoS attacks against other targets.
Conclusion
DNS Split-Horizon is an extremely practical technique for enterprise networks with on-premise servers. Just by mastering the logic of ACLs and Views, you will control the data flow and optimize the user experience. If BIND9 feels too complex, consider installing PowerDNS for a web-based management interface. Good luck with your deployment!
