30 Jan
2004
30 Jan
'04
4:18 p.m.
Hi,
I have a (possibly stupid) question about DNS and bind.
Let's suppose I have a network with DMZ, with external and internal
DNS servers, with different definitions for my domain in both (MX
is different when seen from outside than from inside, more stuff
on the inside, both configured as masters).
Now, for whatever reason, my internal servers are slower to
resolve external addresses than the external ones, and I'd like
to use those as forwarders, for stuff other than my own domain
(and subdomains), instead of going directly to the root servers.
When I try to go through the "forward first" option, it seems
that *all* requests go to the external DNS servers, which is
definitely not wanted - I want the internal servers to continue
serving requests for my own domain or subdomains.
I didn't as yet find the correct way to implement this (maybe
still not enough coffee or I didn't hit upon the right manual/
howto/whatever - checked google, ISC, tldp, ...).
Could someone point me the right way, if it's doable at all?
TIA, Eric
31 Jan
31 Jan
5:16 a.m.
On Fri, Jan 30, 2004 at 05:18:51PM +0100, Eric Dondelinger wrote:
Let's suppose I have a network with DMZ, with
external and internal
DNS servers, with different definitions for my domain in both
Now, for whatever reason, my internal servers are
slower to
resolve external addresses than the external ones,
Probably because the external ones (your ISP's, I guess) often already
have the answer in their cache, while yours must do full resolution.
and I'd like to use those as forwarders, for
stuff other than my own
domain (and subdomains),
When I try to go through the "forward first"
option, it seems that
*all* requests go to the external DNS servers,
Err... I'm using such a setup, and I have never encountered any
problem. How did you "see" that all requests go to the external DNS
servers?
I checked with tcpdump, a query for an internal name doesn't generate
any DNS traffic to the outside. Here is my named.conf:
options {
directory "/var/cache/bind";
// If there is a firewall between you and nameservers you want
// to talk to, you might need to uncomment the query-source
// directive below. Previous versions of BIND always asked
// questions using port 53, but BIND 8.1 and later use an unprivileged
// port by default.
// query-source address * port 53;
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
forwarders {
194.109.104.104;
194.109.6.66;
};
forward first;
auth-nxdomain no; # conform to RFC1035
allow-query {
local;
};
allow-transfer {
};
listen-on {
127.0.0.1;
10.0.0.0/24;
public_ip4;
};
# Can you believe this? It won't bind to one specific address!!
listen-on-v6 {
any;
};
};
acl local {
127.0.0.1;
10.0.0.0/24;
2001:888:19f0::/64;
::1;
};
acl slaves {
212.204.230.141;
};
acl public_ip4 { 213.84.238.144; };
acl public_ip6 { 2001:888:19f0::1; };
acl public_ips {
public_ip4;
public_ip6;
};
view private {
match-clients { local; } ;
recursion yes;
allow-query { local; };
# The common rigmarole
// prime the server with knowledge of the root servers
zone "." {
type hint;
file "/etc/bind/db.root";
};
// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912
zone "localhost" {
type master;
file "/etc/bind/db.local";
};
zone "127.in-addr.arpa" {
type master;
file "/etc/bind/db.127";
};
zone "0.in-addr.arpa" {
type master;
file "/etc/bind/db.0";
};
zone "255.in-addr.arpa" {
type master;
file "/etc/bind/db.255";
};
# My domains
zone "mamane.lu" {
type master;
file "/etc/bind/db.mamane.lu";
};
zone "0.f.9.1.8.8.8.0.1.0.0.2.ip6.arpa" {
type master;
file "/etc/bind/db.2001:888:19f0";
};
# Semi-deprecated. For compatibility use only!
# This means it contains everything that deals with
# private IPv4 addresses. Services will migrate
# to .mamane.lu as they go to IPv6.
# When not using IPv4 any more, this zone will disappear.
zone "home.mamane.lu" {
type master;
file "/etc/bind/db.home";
};
# Now, things that are specific to my internal IPv4 network
zone "0.0.10.in-addr.arpa" {
type master;
file "/etc/bind/db.10.0.0";
};
zone "1.0.10.in-addr.arpa" {
type master;
file "/etc/bind/db.10.0.1";
};
};
# I'm the only IPv6-reachable DNS,
# so serve them. Don't be publicly reachable
# any more when topaz gets IPv6
view public_ipv6 {
match-destinations { public_ip6; };
# Only IPv6 clients!
# No IPv4 addresses, no IPv4-mapped addresses, and no local clients.
match-clients { ! 0.0.0.0/0; ! ::ffff:0.0.0.0/80; !local; any;};
allow-query { any; };
allow-transfer { none; };
recursion no;
zone "mamane.lu" {
type master;
file "/etc/bind/db.mamane.lu";
};
zone "0.f.9.1.8.8.8.0.1.0.0.2.ip6.arpa" {
type master;
file "/etc/bind/db.2001:888:19f0";
};
};
# Public IPv4 access is only for slaves!
view slaves {
match-destinations { public_ip4; } ;
match-clients { slaves; } ;
recursion no;
allow-query { slaves; };
allow-transfer { slaves; };
zone "mamane.lu" {
type master;
file "/etc/bind/db.mamane.lu";
};
zone "0.f.9.1.8.8.8.0.1.0.0.2.ip6.arpa" {
type master;
file "/etc/bind/db.2001:888:19f0";
};
};
--
Lionel
8:58 a.m.
Hi Lionel,
On Sat, 31 Jan 2004, Lionel Elie Mamane wrote:
Well, in this case it also might have to do with quite heavy load
on the internal servers, which are rather old and slow machines,
doing much other stuff than just plain DNS.
Well, there are delegations for subdomains to DNS servers on the
internal network. As soon as I activate "forward first", I won't
get those to answer my request for an MX, but I'll get the answer
as defined on the outside.
Example: dig mx sub1.domain.lu will query my internal server, who's
going to refer me to the DNS for that sub1.domain.lu subdomain, and
I'll get mail.sub1.domain.lu as MX (tried from an internal box).
With forward first, I'll get the external mail exchanger for
*.domain.lu. All in all, this will cause mail loops (between the
internal and external mail servers), which obviously isn't wanted.
Oh, the internal servers are still running bind8, in case it matters.
I checked with tcpdump, a query for an internal name
doesn't generate
any DNS traffic to the outside. Here is my named.conf:
Maybe it is because not everything is defined on those internal
servers, but partly delegated to others (on the internal network).
[snip config]
Thanks for the input anyway!
Apropos, I saw you're already configured for IPv6 - can you point
out a simple good nice introduction? I've checked some sites, but
those were either way too simple or way to deep (RFCs) into the
matter.
Thanks, Eric
10:54 a.m.
On Sat, Jan 31, 2004 at 09:58:15AM +0100, Eric Dondelinger wrote:
>> Let's suppose I have a network with DMZ, with external and internal
>> DNS servers, with different definitions for my domain in both
>> and I'd like to use those as forwarders,
for stuff other than my own
>> domain (and subdomains),
>> When I try to go through the "forward
first" option, it seems that
>> *all* requests go to the external DNS servers,
Oh, the internal servers are still running bind8, in
case it
matters.
I don't think bind8 supports different responses to different clients
for the same query. You might hack this up, but I think the cache will
screw up the stuff anyway. Use bind9.
Please give me more details.
--
Lionel
7758
days inactive
7759
days old
3 comments
2 participants
participants (2)
-
Eric Dondelinger -
Lionel Elie Mamane