Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to configure bind9 to be a local DNS only with no internet access at all. So I have 5 PCs in my virtual domain xy.com. Within this domain there is no access to the internet.

The DNS server has entries like:

  • pc1.xy.com IN A 10.1.1.1
  • pc2.xy.com IN A 10.1.1.2
  • .
  • .
  • pc5.xy.com IN A 10.1.1.5

Bind is configured correctly but when I do a "dig @localhost pc1" on the DNS server it does not work because he gets stuck contacting the root servers. But I only want him to be local and to answer which IP pc1 has.

How can I achieve this?

share|improve this question
1  
In addition to the answer below, you need you actually lookup a record that's on the server. "pc1" and "pc1.xy.com" are not the same and a DNS server will not make assumptions for you. –  Chris S Jan 6 '12 at 14:03
    
Ok I guess "pc1 IN CNAME pc1.xy.com." will do the job, right? –  Ian Jan 6 '12 at 14:08
1  
In a zone file, names without a trailing period will be assumed to be relative to the zone itself. So if you have a zone example.com, and records in it www IN A 1.2.3.4 and ftp IN A 5.6.7.8 then the FQDN version of those records is www.example.com and ftp.example.com respectively. You should not configure TLDs or records in that namespace. You should configure your clients with a domain name and search domains (if there are multiple), DHCP option 15 and 119 respectively. –  Chris S Jan 6 '12 at 14:36
add comment

3 Answers

up vote 7 down vote accepted

To achieve this you need to create a fake root zone to replace the "root.hints" zone that's normally configured.

In named.conf put this:

zone "." IN {
        type master;
        file "fake.root";
};

and in fake.root put this:

$TTL    300
.               IN      SOA ns. hostmaster.xy.com. (
                        20120101 1800 900 604800 86400
                )
.               IN      NS      ns
ns              IN      A       127.0.0.1

This will prevent all attempts to access the internet to obtain the real root hints.

You can also put your pcN.xy.com entries directly into that root zone, too - there's no need for them to be in their own xy.com zone file, so you can just append the following to fake.root:

$ORIGIN xy.com.
pc1             IN      A       10.1.1.1
pc2             IN      A       10.1.1.2
pc3             IN      A       10.1.1.3
pc4             IN      A       10.1.1.4
pc5             IN      A       10.1.1.5

Apart from any options { } that you may need (ACLs?) that's it - nothing else required.

share|improve this answer
add comment

You need to disable recursion:

Add to the config:

allow-transfer {“none”;};

allow-recursion {“none”;};

My config "named.conf" looks like this (on RHEL system):

options {
        allow-query {
        any;
};
allow-recursion {
        none;
};
share|improve this answer
    
Ok in which file do I have to put this? named.conf.options, named.conf.local or db.xy.com or db.10.10.1? –  Ian Jan 6 '12 at 14:09
    
I added both to named.conf.options but now I don't get an answer on "dig @localhost pc1.xy.com" but the WARNING: recursion requested but not available. –  Ian Jan 6 '12 at 14:38
    
For me it is named.conf, but I know what my distro is, I do not know what yours is.. –  Tim Jan 6 '12 at 14:43
    
It's Debian 6. So you put both into the options section of named.conf? –  Ian Jan 6 '12 at 14:46
    
It is declared right after "options" section. See the update to my answer. –  Tim Jan 6 '12 at 16:31
show 2 more comments

You did not describe your configuration in enough detail. I think you are missing the authoritative part. You need to have a block like this in your config files:

zone "domain.lan" {
        type master;
        file "master/db.domain.lan";
        allow-update { none; };
};

where master/db.domain.lan should point to the zone file which should contain the records you posted above. Also, the zone file should have SOA (start of authority) record in its header. The zone file should like like:

domain.lan.     86400   IN SOA  dns.domain.lan. root.dns.domain.lan. ( 1 10800 3600 6044800 86400 )
                86400   IN NS   dns.domain.lan.

dns.domain.lan.      86400   IN   A    10.10.10.1
pc.domain.lan.    86400   IN   A    10.10.10.2

You can customize the names/values/IPs according to your needs.

share|improve this answer
    
@khalid I do have a zone just like you posted it, but bind tries to ask the root servers even if I dig for pc1.xy.com and thus times out. that sucks :( –  Ian Jan 6 '12 at 15:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.