Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I already have a similar configuration working on another host with BIND 8.4.7

I'm migrating to a new name server so I decided to upgrade BIND to 9.7.3

The configuration is similar to this one, but I have added some permissive (maybe redundant) restrictions, trying to make it work.

//named.conf
options {
    listen-on-v6 { any; };
    listen-on { any; };
};
acl "lan" { 127.0.0.1; 192.168.x.0/24; };
view "internal" {
  match-clients { "lan"; };
  match-destinations { any; };
  zone "foo.com" IN {
    type master;
    allow-query { any; };
    allow-recursion { any; };
    file "foo.com.internal.hosts";
  };
};
view "external" {
   match-clients { any; };
   match-destinations { any; };
   zone "foo.com" IN {
     type master;
     allow-query { any; };
     allow-recursion { any; };
     file "foo.com.hosts";
   };
};

There is some testing on localhost.

//nslookup from localhost 
> server 127.0.0.1
Default server: 127.0.0.1
Address: 127.0.0.1#53
> bar
Server:         127.0.0.1
Address:        127.0.0.1#53

** server can't find bar: NXDOMAIN

Testing on the same network.

//nslookup from "lan"
> server 192.168.x.y
Default server: 192.168.x.y
Address: 192.168.x.y#53
> bar
Server:     192.168.x.y
Address:    192.168.x.y#53

** server can't find bar: NXDOMAIN

Testing from another network fails.

//nslookup from outside "lan", 192.168.x.y NAT'd to 192.168.z.y
> server 192.168.z.y
Default server: 192.168.z.y
Address: 192.168.z.y#53
> bar
Server:     192.168.z.y
Address:    192.168.z.y#53

** server can't find bar: REFUSED

So, my question is, why this configuration does not work on the newer BIND?

share|improve this question
    
What is the output of dig @localhost bar.foo.com? –  Mark Wagner May 2 '11 at 18:58
    
I have forgoten to include the output of the named.run file: 02-May-2011 12:37:26.674 client 10.a.b.c#59919: query (cache) 'bar/A/IN' denied –  AndresVia May 2 '11 at 19:12
    
@embobo I just got ";; connection timed out; no servers could be reached" (pastebin.com/tfHM1e3C) , and nothing on the named.run –  AndresVia May 2 '11 at 19:23
    
@embobo running dig on the same server where BIND is running gives the following "com. 800 IN SOA a.gtld-servers.net. nstld.verisign-grs.com. 1304364356 1800 900 604800 86400" (pastebin.com/g0nNeam7) the resolv.conf file is empty. –  AndresVia May 2 '11 at 19:31

1 Answer 1

One must specify the exact remote network specification, thats what I have found, "any" do not work as expected for me, neither defining a broader network than what is actually being querying the name server, for example, if the external network is 10.2.11.0/24 using an ACL defined as 10.2.0.0/23 will not match, that was my problem.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.