// Module included in the following assemblies:
//
// * migrating_from_ocp_3_to_4/planning-considerations-3-4.adoc
// * migration_toolkit_for_containers/network-considerations-mtc.adoc

:_mod-docs-content-type: PROCEDURE
[id="migration-isolating-dns-domain-of-target-cluster-from-clients_{context}"]
= Isolating the DNS domain of the target cluster from the clients

You can allow the clients' requests sent to the DNS domain of the source cluster to reach the DNS domain of the target cluster without exposing the target cluster to the clients.

.Procedure

. Place an exterior network component, such as an application load balancer or a reverse proxy, between the clients and the target cluster.

. Update the application FQDN on the source cluster in the DNS server to return the IP address of the exterior network component.

. Configure the network component to send requests received for the application in the source domain to the load balancer in the target cluster domain.

. Create a wildcard DNS record for the `*.apps.source.example.com` domain that points to the IP address of the load balancer of the source cluster.

. Create a DNS record for each application that points to the IP address of the exterior network component in front of the target cluster. A specific DNS record has higher priority than a wildcard record, so no conflict arises when the application FQDN is resolved.

[NOTE]
====
* The exterior network component must terminate all secure TLS connections. If the connections pass through to the target cluster load balancer, the FQDN of the target application is exposed to the client and certificate errors occur.

* The applications must not return links referencing the target cluster domain to the clients. Otherwise, parts of the application might not load or work properly.
====
