Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm going to start this off with a quick, yes this is similar to many other questions, but I have a very specific question related to how to configure bind9 which doesn't seem to have been covered else where.

This is my situation:

  • We have a bunch of dev machines behind a firewall.
  • The dev machines have no external access.
  • All programmers are on a vpn that gives them access to the dev machines.

I'd like to have a way to allow multiple 'dev' DNS records, without messing around with our public DNS records.

Broadly speaking this is my plan:

  • Run a DNS server on the dev network
  • Have all programmers have a pair of DNS servers defined on their local network configs

So it'd work like this; I have a bunch of dev dns entries, eg.

*.dev.mysite1.com -> vpn ip *.dev.mysite2.com -> vpn ip

However, since the client machines have two DNS entries defined, they will chain the request and requests for www.mysite1.com, etc. will resolve to the normal (public) dns server.

So, question:

How do you setup bind so that it will resolve a subdomain (eg. dev.mysite.com) but will not resolve any other subdomains (eg. www.mysite.com)?

This is probably trivial to do, but after installing bind and creating a zone file, things seem to not be working?

What should my named.conf.local file / specific zone file look like to resolve a specific subdomain, but not the entire domain?

--

Edit: Yes, I saw Overriding some DNS entries in BIND for internal networks, but I was sort of hoping there was a way to do this easily using bind...

share|improve this question

3 Answers 3

Strictly speaking not an answer to your question (configuring bind), but maybe still a solution to your problem.

I don't know how many programmers and dev machines you're talking about, but it might be very feasible to include all dev machines into the appropriate hosts-files on the programmer's clients.

share|improve this answer

You need to delegate dev and make the nameservers authoritative.

On site1.com:

dev.site1.com.            NS      ns1.dev.site1.com.
dev.site1.com.            NS      ns2.dev.site1.com.
ns1.dev.site1.com.        A       10.0.0.1
ns2.dev.site1.com.        A       10.0.0.2

On ns1/ns2.dev.site1.com:

@       SOA     ns1.dev.site1.com. hostmaster.site1.com ( 2011050802 3H 1H 1W 10M )
dev.site1.com.            NS      ns1.dev.site1.com.
dev.site1.com.            NS      ns2.dev.site1.com.
ns1.dev.site1.com.        A       10.0.0.1
ns2.dev.site1.com.        A       10.0.0.2
share|improve this answer
    
I don't like the idea of putting resources for private networks in public name servers. RFC 1597 at the very least suggests querying an internal server from inside the private network. –  Sven May 10 '11 at 8:08
    
who said anything about public nameservers? You can do this delegation on your private internal nameserver. Or look at views. –  dmourati May 10 '11 at 21:51

Using two DNS entries on your clients will not work. If they query the first server and it returns that it couldn't find the entry, they will not try the second server but fail instead.

The usual way to go around this is to push out a DNS entry for your internal server via DHCP when your users connect to the VPN. This server then has to be configured to be authoritative for dev.mysite1.com and/or dev.mysite2.com and either be recursive or redirect to your primary DNS server for every other query.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.