DNS Views and Medulla Relay in the DMZ
Since the Medulla agent configuration is unique across the entire network, it supports only a single domain name. To allow machines to reach the server from both the private network and the outside via this single address, you must use a single domain name combined with Split-Horizon DNS or a Round-Robin configuration.
DNS Views
Principle
A DNS view allows different responses to be returned for the same name depending on the origin of the request.
- Internal workstations → internal Medulla server
- External workstations → Medulla relay in the DMZ
Benefits
- Only one DNS name to configure
- No difference in configuration on the workstations side
- The internal Medulla server is not exposed
- Clear and secure architecture
Key takeaways
DNS views automatically route workstations to the correct Medulla access point, while maintaining a unique name and simple configuration.
Reference article on Bind9: https://kb.isc.org/docs/aa-00851
Round-Robin
Additionally, if you do not wish to configure DNS Views, you can opt for an alternative solution by setting up a Round-Robin mechanism. This mechanism distributes requests among multiple IP addresses associated with the same domain name, thereby ensuring a balanced distribution of connections.
To do this, you need to follow two steps:
- Define the internal IP address of the primary Medulla server.
- Define the public IP address of the DMZ relay server.