3

I already have a similar configuration working on another host with BIND 8.4.7

I'm migrating to a new name server so I decided to upgrade BIND to 9.7.3

The configuration is similar to this one, but I have added some permissive (maybe redundant) restrictions, trying to make it work.

//named.conf
options {
    listen-on-v6 { any; };
    listen-on { any; };
};
acl "lan" { 127.0.0.1; 192.168.x.0/24; };
view "internal" {
  match-clients { "lan"; };
  match-destinations { any; };
  zone "foo.com" IN {
    type master;
    allow-query { any; };
    allow-recursion { any; };
    file "foo.com.internal.hosts";
  };
};
view "external" {
   match-clients { any; };
   match-destinations { any; };
   zone "foo.com" IN {
     type master;
     allow-query { any; };
     allow-recursion { any; };
     file "foo.com.hosts";
   };
};

There is some testing on localhost.

//nslookup from localhost 
> server 127.0.0.1
Default server: 127.0.0.1
Address: 127.0.0.1#53
> bar
Server:         127.0.0.1
Address:        127.0.0.1#53

** server can't find bar: NXDOMAIN

Testing on the same network.

//nslookup from "lan"
> server 192.168.x.y
Default server: 192.168.x.y
Address: 192.168.x.y#53
> bar
Server:     192.168.x.y
Address:    192.168.x.y#53

** server can't find bar: NXDOMAIN

Testing from another network fails.

//nslookup from outside "lan", 192.168.x.y NAT'd to 192.168.z.y
> server 192.168.z.y
Default server: 192.168.z.y
Address: 192.168.z.y#53
> bar
Server:     192.168.z.y
Address:    192.168.z.y#53

** server can't find bar: REFUSED

So, my question is, why this configuration does not work on the newer BIND?

4
  • What is the output of dig @localhost bar.foo.com? May 2, 2011 at 18:58
  • I have forgoten to include the output of the named.run file: 02-May-2011 12:37:26.674 client 10.a.b.c#59919: query (cache) 'bar/A/IN' denied
    – AndresVia
    May 2, 2011 at 19:12
  • @embobo I just got ";; connection timed out; no servers could be reached" (pastebin.com/tfHM1e3C) , and nothing on the named.run
    – AndresVia
    May 2, 2011 at 19:23
  • @embobo running dig on the same server where BIND is running gives the following "com. 800 IN SOA a.gtld-servers.net. nstld.verisign-grs.com. 1304364356 1800 900 604800 86400" (pastebin.com/g0nNeam7) the resolv.conf file is empty.
    – AndresVia
    May 2, 2011 at 19:31

1 Answer 1

1

One must specify the exact remote network specification, thats what I have found, "any" do not work as expected for me, neither defining a broader network than what is actually being querying the name server, for example, if the external network is 10.2.11.0/24 using an ACL defined as 10.2.0.0/23 will not match, that was my problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .