We have a server on which we host private services. These services can also be access from rest of the world but there is slight difference on application level based on from which IP request came. 

Applications run on subdomains like app1.domain.com, so i want to add \*.domain.com to exception somewhere and point it to our VPN IP instead of public. /etc/hosts is an overkill as there are 25 client systems at this office and further more i would have to update everyone's /etc/hosts everytime we launch a new app. I am looking for more generic and one time solution.

Could DNS be my solution? but even in that case won't i have to add a new entry everytime a new app is launched? (which is much better than adding it to 25 machines though but still...)

What do you suggest?