Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running Centos 5.8 (bind 9.3.6).

Here is my issue... I admin my own DNS server which is colocated at an ISP.

I would like to allow a select few external systems use my DNS server. The external systems can have a dynamic IP address, so I am not sure how this would be accomplished.

In my named.conf, there is an allow-query{} and allow-recursion{}. It seems both of those take an IP address, but i need to specify a hostname (at least a cname). This is not a DNS server I want allowing queries from anyone but a few. Is there some way to provide DNS to the few select external systems without having to hand modify their IPs in the config?

share|improve this question

closed as off topic by Brent Pabst, Shane Madden, John Gardeniers, Bryan, rnxrx Oct 26 '12 at 1:06

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

Don't do this.

Seriously, don't. There is absolutely no good reason I can think of for you to do this.
Use your ISP's DNS, or Google's public DNS servers.

If you insist on doing this you may as well just make the server accept recursive queries from the world -- you've already outlined the kind of nasty hackery that would be required to make it work otherwise, and it's nasty.

share|improve this answer
2  
There are several good reasons to do it. 1) Privacy, dont want my ISP or Google mining my DNS query. 2) Backup, I have had my ISP DNS servers go down and used mine as a backup. –  krbvroc1 Oct 26 '12 at 4:16
    
@krbvroc1 None of those is a good reason to mess with adding/removing ACL entries for a random dynamic IP every time your address changes. DNS was never designed to deal with that, so no DNS servers handle it, and the hackery required to make it work is a Bad Idea. Either your DNS server is open to the world, open to a specific subnet (which is probably the best solution for you if you insist on this -- allow your ISP's entire range), or closed to the world/authoritative-only. –  voretaq7 Oct 26 '12 at 15:12
1  
I'm not sure why you feel you are the authority on what is a good or bad idea and are so hostile to my scenario. It sounds like DNS does not provide the flexibility in its ACL design. Forcing the opening of an entire ISP subnet versus a select few addresses (and an at run time method to change it) seems absurd. What I want to accomplish would be no different than allowing VPN access and routing DNS queries across the VPN. I will chalk this up to a limitation in the granularity of the ACL interface. Whether it is a good idea is really a judgement of the server admin, me. –  krbvroc1 Oct 27 '12 at 3:14
1  
@voretaq7 When you live in a country that blocks all open recursive nameservers and spoofs known popular ones, there is good reason to do this. This answer is for too dismissive. –  Caleb Apr 8 at 10:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.