Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I recently set up two nameservers, of course, master (ns1) and slave (ns2). My servers are 192.168.168.16 and .17 and they're both running BIND9. Everything worked fine, zone transfers were working, queries, etc. I went to implement views as I have some domains that will need to be queried from the internet, but I'd also like to address my internal machines and only have them respond to internal queries. I threw in a generic "lr" domain to represent my internal machines and of course have my 192.168.168 network for PTR records which should also be internal, then I set the default zones, 0, 127, and 255 up for internal view only. Here's the config:

acl internal {
192.168.168.0/24;
10.254.254.2;
localhost;
};
view "internal" {
match-clients {
    internal;
    };
recursion yes;
also-notify {
    192.168.168.17;
    };
zone "0.in-addr.arpa" {
    type master;
    file "/etc/bind/db.0";
    };
zone "127.in-addr.arpa" {
    type master;
    file "/etc/bind/db.127";
    };
zone "168.168.192.in-addr.arpa" {
    type master;
    file "/var/lib/bind/192.168.168.rev";
    };
zone "255.in-addr.arpa" {
    type master;
    file "/etc/bind/db.255";
    };
zone "localhost" {
    type master;
    file "/etc/bind/db.local";
    };
zone "mylocalnet" {
    type master;
    file "/var/lib/bind/mylocalnet.internal.hosts";
    };
};

view "public" {
match-clients {
    any;
    };
recursion no;
also-notify {
    192.168.168.17;
    };
zone "external" {
    type master;
    file "/var/lib/bind/external.public.hosts";
    };
};

Now, when the external zone (in public view) attempts to transfer, I get the following in the logs:

Jun  5 13:44:25 ns2 named[26887]: zone external/IN/public: refresh: non-authoritative answer from master 192.168.168.16#53 (source 0.0.0.0#0)

When the mylocalnet zone (in internal) attempts to transfer, it transfers flawlessly.

If I take the external zone and put it in the internal view, it transfers fine as well. It seems that only zones in the public view will not transfer.

Here's the config of the slave:

view "internal" {
recursion yes;
allow-transfer {
    192.168.168.16;
    };
match-clients {
    192.168.168.0/24;
    10.254.254.2;
    };
allow-notify {
    192.168.168.16;
    };
zone "0.in-addr.arpa" {
    type master;
    file "/etc/bind/db.0";
    };
zone "127.in-addr.arpa" {
    type master;
    file "/etc/bind/db.127";
    };
zone "168.168.192.in-addr.arpa" {
    type slave;
    masters {
        192.168.168.16;
        };
    file "/var/lib/bind/192.168.168.rev";
    };
zone "255.in-addr.arpa" {
    type master;
    file "/etc/bind/db.255";
    };
zone "localhost" {
    type master;
    file "/etc/bind/db.local";
    };
zone "mylocalnet" {
    type slave;
    masters {
        192.168.168.16;
        };
    file "/var/lib/bind/mylocalnet.internal.hosts";
    };
};
view "public" {
recursion no;
allow-transfer {
    192.168.168.16;
    };
allow-notify {
    192.168.168.16;
    };
zone "external" {
    type slave;
    masters {
        192.168.168.16;
        };
    file "/var/lib/bind/external.public.hosts";
    };
};

Anyone know what I'm doing wrong?

share|improve this question

1 Answer 1

From http://www.zytrax.com/books/dns/ch6/index.html#view : "All the required zones must be declared in each view." Viz, you need to add the external zone to the internal view.

share|improve this answer
    
The external zone is in the public view. Substitute a legitimate domain that should be externally accessible from the internet. Inversely, the mylocalnet would be a domain that should only answer from internal subnets. If I added the external zone to the internal view, I would expect that you wouldn't get authoritative answers from the internet. –  Buee Jun 5 '13 at 19:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.