2

I have an AirPort Extreme and Express which provide a guest and a private wireless network. I also have a Mac server (192.168.1.10) running on the LAN. I want that server to be accessed only on the private wireless network.

I want the hostname of the Mac server to resolve to 192.168.1.10 on the private wireless network instead of resolving to my external IP address. This means that DHCP clients on the private network need to have 192.168.1.10 as the primary DNS server and 8.8.8.8 as the secondary DNS server. The clients on the guest network on the other hand need different DNS servers (eg. 8.8.8.8 and 8.8.4.4).

How can I configure these settings separately for the private and guest network on the AirPort Extreme and Express?

Improve this question

3 Answers 3

Reset to default
2

What you are suggesting will provide name resolution to the 192.168.1 subnet but has nothing to do with restricting access.

The correct way to do what you want is to firewall the device, or have no routing between your subnets.

If you do want to set up just the DNS settings then all you have to do is propagate them via DHCP. This means having two separate DHCP scopes, one with the google DNS servers, and one with your internal DNS server.

Improve this answer
5
  • Yes, they are in a different IP range. Apple takes care of that: the guest network is on different VLAN than the private network. So there already is no routing between the subnets. So if I set 192.168.1.10 as the primary DNS the guest clients fail to connect to the server, obviously. That's why I want to change the DNS settings per network. Is it possible to have two separate DHCP scopes on an AirPort Extreme or Express?
    – Stan
    Dec 19, 2013 at 15:07
  • DNS and routing are separate issues, setting the DNS to 192.168.1.10 will have no impact. If your two subnets are on a different VLAN then you already have two separate DHCP scopes, and all you need to do is change the DNS being pushed out.
    – Deesbek
    Dec 19, 2013 at 15:28
  • Okay, thanks. I configured the DNS servers of the AirPort Extreme to 192.168.1.10 and 192.168.1.1, nslookup google.com 192.168.1.10 works, but nslookup google.com 192.168.1.1 doesn't. Guest computers get 172.16.42.1 as their only DNS server, but nslookup google.com doesn't work either. What's happening?
    – Stan
    Dec 19, 2013 at 20:17
  • Where is 1.1 coming from? is your wifi 172.16? I will be in chat if you want to discuss further.
    – Deesbek
    Dec 19, 2013 at 20:31
  • I'm sorry, 1.1 is the Airport Extreme itself. I noticed the DNS settings in the Airport Extreme are only applied to the private network (192.168.1.0) and the guest network (172.16.42.0) gets 172.16.42.1 as the DNS server, which is the Airport itself. But the Airport doesn't respond to nslookups.
    – Stan
    Dec 19, 2013 at 21:15
0

What you could do is set-up your airports extrem/express to use just the Google's DNS.

And for your local peripheral you modify the network settings, you can still keep DHCP but you override the DNS settings and put first your Mac Server and second the Google DNS. If you are a home user with a few devices, that should not be too much manual work.

Improve this answer
1
  • Yes, but I'm not a home user; I use the same computer at my office. Thanks, but this isn't a solution for me.
    – Stan
    Dec 19, 2013 at 15:04
0

If you are unable to configure seperate settings for the DHCP server to hand out differnt DNS info to the different networks (which you cannot do with Apple's standard Airport Utility), I THINK that telling the Airport that the DNS servers are 192.168.1.10 and 8.8.8.8 (or your ISP's DNS server) will mostly have the effect that you want:

  1. Your local devices will use 192.168.1.10 since that will respond quickest.

  2. Devices on the "guest" network may try to connect to 192.168.1.10 but since it won't respond, they will go to 8.8.8.8 for their information.

This type of setup is not ideal, since it is possible that your local devices won't be able to talk to other local devices if they somehow are using the 8.8.8.8 server which doesn't know about names on your private network - but that should be a rare event since the local DNS server should be preferred by local clients as it generally would be faster. The "guest" devices might experience some lag if they are continually waiting for a non-responsive connection to 192.168.1.10 before trying 8.8.8.8, but I think most devices will locally cache results for things that they have recently looked up and they may preferrentially use 8.8.8.8 once it is found to be faster than the unreachable 192.168.1.10.

This response bascially says the same thing: https://discussions.apple.com/message/24330741#message24330741

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .