Accessing internal zones over a VPN

[Anthony Chavez]

Topology:
       -----              -----          ------
LAN1<->|FW1|<->Internet<->|FW2|<->LAN2<->|DNS1|
       -----              -----          ------
         |
         R1
         |
         v
       -----         -----          ------
       |FW3|<->VPN<->|FW4|<->LAN3<->|DNS2|
       -----         -----          ------
Notes:
R1: static route diverting traffic destined for LAN3
FW1: BIND8.3.6-REL-p1 (slave DNS for LAN1 and LAN2)
DNS1: BIND8.3.4-REL (master DNS for LAN1 and LAN2)
DNS2: BIND9.2.3 (master DNS for LAN3---slaves are on the Internet)

All firewalls are fully capable NAT routers/packet filters.

Problem:
I want to enable a subset of machines in LAN1 to be able to query DNS2
for LAN3's zone file.

Hypotheses:
When the subset queries the DNS on FW1, it gets an NS record and an
associated A record containing the FW4's external IP.  It needs to
somehow get DNS2's IP instead.

FW4 is a NAT router, which means that all queries to DNS2, including
those inside LAN3, appear to come from FW4.  Therefore, FW1 is where the
configuration must take place.

One possible solution could involve additional static routes and NAT
routing along the path from LAN1 to FW4's external subnet.

Bonus question:
How can I accomplish the same thing in reverse, i.e., how can I enable a
subset of machines in LAN3 to be able to query FW1 for LAN1/LAN2's zone
files?

I've done some research into a solution for this, but so far have come
up empty.  Any suggestions would much be appreciated!

-- 
Anthony Chavez                             http://www.anthonychavez.org/
mailto:acc at anthonychavez.org                jabber:acc at anthonychavez.org


-- Attached file included as plaintext by Ecartis --

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQBAQQvPbZTbIaRBRXERAkEhAJ9sy5IoL+wk562xKA349WKoj/NLWgCdEE2B
qtXC+87zuu7wv2NmCb7MUZE=
=8/36
-----END PGP SIGNATURE-----