domain-name-system – 外部dns到内部dns

>您只有1个公共IP,它是分配给路由器WAN接口的IP.
>您的路由器是SOHO型号,只能在其WAN接口上分配一个IP.即如果您从ISP购买了额外的静态IP,则需要更换路由器来处理此问题.

I have a local DNS server inside my network and have set up a few A Name records to some of my internal sites (i.e. app1.domain.com,app2.domain.com) and the dns resolves internally and loads the sites just fine.

我假设你的内部DNS服务器配置为返回服务器的RFC1918私有地址.这使得此服务器上的DNS区域对局域网外的人员无用.如果他们从互联网上获得10.1.1.x的响应,则会被丢弃.

Now I have a godaddy domain as well and want to allow external access for a few of these sites. I made the same A Name records in godaddy and pointed them to my single WAN IP. Before I was port forwarding all incoming port 80 traffic on the router directly to the IP of my internal web server just as an ad-hoc solution and it worked fine.

好.这将起作用,但正如您所见,它不具备可扩展性.

Now I have a second web server that I need to expose on a different internal server. So for the port 80 traffic I need to send app1 to my internal ip 10.1.1.23 and app2 to 10.1.1.24 when clients try to connect from the outside.

So I modified my router to forward external port 80 traffic to 10.1.1.11 (my internal DNS server) on port 53 for both tcp/udp. The DNS server is a Windows Server 2008 R2 machine. It looks like the firewall exceptions are also setup to allow incoming traffic on port 53,but anytime I try to access the site from an external client,nothing loads. I know the godaddy is forwarding the traffic to my WAN because I can do a tracert that resolves to my WAN IP.

这是你变得怪异的地方,我的朋友.真的,真的很奇怪.您正在将HTTP请求转发到DNS服务器并转换端口.这就像是把一封用英文写的信寄给美国某人,把它从邮局拿出来,放在缅甸某人的邮箱里,想知道你为什么还没有收到回复.

HTTP和DNS是完全不同的协议. HTTP是为您的网页提供服务的东西. DNS将完全限定名称转换为IP地址.它们不可互换. DNS服务器将查看您转发给它的HTTP数据包并说出“搞砸了这些东西,不知道那是什么”,然后就把它扔进垃圾桶,就像你的新笔友一样缅甸.

好的,既然你知道你哪里出错了,你能做些什么呢？

>获取额外的公共IP并将其分配给您的路由器.这假设您的路由器可以处理此问题.如果不能,您可能需要获得一个新的,或使用选项#2.如果你得到另一个IP和一个可以处理它的路由器,你只需设置Go Daddy将第二个IP用于你的第二个服务器,然后将新IP上的端口80请求转发到新服务器,就像你对第一个服务器所做的那样IP和您的第一台服务器.这将要求您为添加的每个新服务器拥有一个公共IP.>设置反向代理并将所有内容指向您的一个IP地址.你可以使用像apache的mod_proxy或IIS7的ARR这样的东西.您可以告诉Go Daddy的DNS将所有外部站点的所有流量发送到您已拥有的一个IP.在路由器上,您将端口80上的请求转发到充当反向代理的新服务器.此服务器将配置为类似于入站连接的“代理”.您将配置该服务器以根据请求的主机名将所有请求转发到正确的服务器.