Split DNS server requirement

[krm]

Hi,

Just saw the e-mail from 3CX mentioning the requirement of a split DNS setup for future on-premise installs:

Future Requirements for On Premise Installs
In future, on premise installations will require a dedicated IP and a split DNS server setup. Please obtain a manageable DNS server or a dedicated IP. Alternatively, move to 3CX Hosted.

We would like to ask what has changed now, that in the future, a split DNS server setup is required?
Would it not be possible to use an on premise installation without a split DNS server setup in the future? Or what exactly would be the issue when not having a managable split DNS server?

Thanks.

 

[SweetAction]

This is a quote of my post elsewhere that you won't be able to see, but should answer your questions.

I'll try to boil this down the way I understand it - but I am not a 3CX employee so it may be incorrect. To be clear, I understand the networking piece, I don't have inside understanding on this split dns requirement. It doesn't really affect us because we only deploy with Split DNS since 13 years ago, but I know others are affected.

You have a FQDN that covers your 3CX install - example.3cx.us - and an IP - 10.0.1.2.
When configuring a phone you can use either, but the problem is that accessing the IP over HTTPS isn't going to happen because you won't have a SSL cert that covers an internal IP that is trusted by the phone. Thus provisioning isn't happening over a secure channel and is open to interception and MITM attacks.
So instead you need to use the FQDN, which from an external source is fine because it resolves to your public IP and then your router forwards it to the 3CX server. That FQDN has a SSL cert and is considered secure.
However, when inside your network, if that FQDN resolves to the external IP and as a result 1 of 2 things are going to happen:
-1 The traffic will not hit 3CX because your router see same source and destination and this isn't something it can handle (lookup NAT Hairpinning)
-2 The traffic will hit 3CX because your router can handle NAT Hairpinning and can pass it forward

So Split DNS is the way to ensure that from outside the network it gets external IP and inside the network is gets the internal IP (10.0.1.2). This completely avoids the need for your router to get involved (unless you are making requests between VLANs and the router is the L3 device doing it)

As to why 3CX isn't discussing hairpinning - I can only guess. Some reasons might be
1. It's sometimes seen as a security risk
2. Not all routers support it
3. Extra complexity
4. Extra bandwidth incurred

If you can do NAT hairpinning and can't do split dns (which is unlikely, but maybe?) then maybe you can avoid making any changes and just use the FQDN with the same resolution internal and external.

EDIT: Updated words for clarity

The big push is likely that 3CX will stop allowing provisioning and communication over insecure channels (i.e. http), just like when they started forcing a FQDN (back in the 14.x days IIRC)

 

[Alphabetic]

The problem with not setting up split DNS is that your FQDN internally will try and resolve externally. This means your local set up will attempt to get through your firewall using the SIP/RTP ports provisioned as LAN, these wont be open so will fail etc etc. Just stick with setting up split DNS.

 

[kwen1x]

The problem with not setting up split DNS is that your FQDN internally will try and resolve externally. This means your local set up will attempt to get through your firewall using the SIP/RTP ports provisioned as LAN, these wont be open so will fail etc etc. Just stick with setting up split DNS.

3CX pbx is in seperate VLAN and already routed over and through firewall for internal AND external clients.
Split DNS is 'not' an issue/topic: right ?!

 

[SteveITS]

(deleted)

 

[SweetAction]

Not necessarily. If they are behind the same NAT device you still need SplitDNS or NAT Hairpinning for traffic to reach the 3CX server.

 

[SteveITS]

Not necessarily. If they are behind the same NAT device you still need SplitDNS or NAT Hairpinning for traffic to reach the 3CX server.

Yeah my bad not enough coffee.

 

[kwen1x]

welcome to the world of 'NAT hairpinning' or 'SNAT' or 'Static NAT'... what's in a name ?

You mentionned split DNS or NAT hairpinning, so in my 'NAT hair pinning' case/setup, I don't need split DNS: correct ?!

 

[SweetAction]

welcome to the world of 'NAT hairpinning' or 'SNAT' or 'Static NAT'... what's in a name ?

You mentionned split DNS or NAT hairpinning, so in my 'NAT hair pinning' case/setup, I don't need split DNS: correct ?!

As long as the traffic can get from the endpoint to the PBX by FQDN, it shouldn't matter HOW you accomplish this.

 

[kwen1x]

As long as the traffic can get from the endpoint to the PBX by FQDN, it shouldn't matter HOW you accomplish this.

ok, clear.
So it is just a warning after all....

 

[N_G]

Indeed as Sweetaction explained, as long as the apps and web client can access the PBX via a single, properly resolvable FQDN from anywhere you want to use them, then its fine. Phones should be provisioned by secure URL although you can switch this off at your own risk if you wish.

 

[ltri37]

So it is just a warning after all....

It's a breaking undocumented change now in Update 8.

While update 8 release notes claim:

It should be noted that RPS necessitates Split DNS, which will now be a requirement for all future installations and will be enforced in the subsequent version of 3CX.

In reality update 8 enables Split DNS automatically based on some broken assumptions ("you did enable SplitDNS when installing this instance!" -> "nope, this was not even a thing in the install wizard in previous versions, so no").

The result is that secondary NICs without Split DNS are no longer working (phone provisioning page no longer shows interfaces other than the primary interface).

Do not press "OK" in the provisioning page of the phone in Update 8, unless you want to disconnect the phones.

 

[Oliver Broad]

FWIW Some "SOHO" tier routers can do split DNS out of the box. If you're using a Windows server it isn't hard to set up a DNS proxy running on the same box. On some Draytek routers if the server is set as DMZ then it will correctly route the public IP to the server even if the connection originated on the inside ("hairpin") though IMO split DNS seems more efficient.

 

[ltri37]

I have posted an explanation of the change and a workaround here:

https://www.3cx.com/community/threads/version-18-update-8-final.121882/page-4#post-570659


Split DNS is not required at all. Full access to all services via FQDN is, as Sweetaction already wrote in this thread.