3

A brief summary of my problem is that we have started a DNS server upgrade here at my facility.

We currently have 2 internal dns servers and 2 external dns servers. We are upgrading to new equipment and merging our servers so we have 1 master and 1 slave that will take care of both internal and external dns. Both servers have two NIC's that have been IP'd with one address in the public external network and one in the internal network. On my master I have setup an Internal view that is only accessible from our internal network ranges and an external view that is allowed to be queried by anyone. I have everything setup and DNS resolution works fine. The problem I am getting though is that that when I configured the slave and set it up, the slave will only inherit updates for zones listed in the Internal view. All external view zones give an error of 

;<<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6_6.2 <<>> IN AXFR 43.96.32.in-addr.arpa @129.yy.yy.10 
;; global options: +cmd 
; Transfer failed.

I have been googling like crazy and cannot find a solution hopefully someone on here might have an idea of why this is occuring.

Below I will give the samples of my master / slave named.conf files. My system is currently running RHEL 6.6 and Bind DNS 9.8.2.

Master - Named.conf

acl internal_hosts { 10.101.0.0/16; 172.21.0.0/16;
10.2.0.0/16; 169.254.0.0/16;
172.23.0.0/16; 32.0.0.0/8;
12.109.164.0/24; 12.109.165.0/24;
63.79.18.0/24; 63.88.0.0/16;
129.42.0.0/16; 4.30.26.0/24;
4.28.188.0/24; 172.21.131.248/29;};
acl internal_slave { 10.xx.xx.2; };
acl external_slave { 129.yy.yy.11; };
acl internal_master { 10.xx.xx.1; };
acl external_master { 129.yy.yy.10; };

options {
    directory "/etc";
    pid-file "/var/run/named/named.pid";
    dnssec-enable no;
    query-source port 53;
    forward only;
    notify yes;
    allow-query { any; };
    listen-on {
        10.xx.xx.1;
        127.0.0.1;
        129.yy.yy.10;
    };
    forwarders {
        129.34.20.80;
        198.4.83.35;
        4.2.2.2;
        8.8.8.8;
    };
    allow-transfer {127.0.0.1; };
};


server 10.xx.xx.2 {
    transfer-format many-answers;
    transfers 10000;
};
server 129.yy.yy.11 {
    transfer-format many-answers;
    transfers 10000;
};

view "Internal" {

    match-clients { internal_hosts; !external_slave; internal_slave; };
    also-notify { 10.xx.xx.2; };
    allow-transfer { internal_slave; };
    recursion yes;
    allow-recursion { internal_hosts; };
    transfer-source 10.xx.xx.1;


    zone "64.2.10.in-addr.arpa" {
        type master;
        also-notify { 10.xx.xx.2; };
        notify yes;
        allow-transfer { internal_slave; };
        file "/var/named/10.2.64.rev";
    };


view "External" {

    match-clients { !internal_slave; external_slave; any; };
    recursion no;
    allow-transfer { external_slave; };
    also-notify { 129.yy.yy.11; };
    transfer-source 129.yy.yy.10;

    zone "50.146.204.in-addr.arpa" {
        type master;
        notify yes;
        also-notify {129.yy.yy.11;};
        allow-transfer {external_slave;};
        file "/var/named/204.146.50.rev";
    };

Slave - Named.conf

acl internal_hosts { 10.101.0.0/16; 172.21.0.0/16;
    10.2.0.0/16; 169.254.0.0/16;
    172.23.0.0/16; 32.0.0.0/8;
    12.109.164.0/24; 12.109.165.0/24;
    63.79.18.0/24; 63.88.0.0/16;
    129.42.0.0/16; 4.30.26.0/24;
    4.28.188.0/24; 172.21.131.248/29;
};
acl internal_slave { 10.xx.xx.2; };
acl external_slave { 129.yy.yy.11; };
acl internal_master { 10.xx.xx.1; };
acl external_master { 129.yy.yy.10; };

options {
    directory "/etc";
    pid-file "/var/run/named/named.pid";
    dnssec-enable no;
    query-source port 53;
    forward only;
    allow-query { any; };
    listen-on port 53 {
        127.0.0.1;
        10.xx.xx.2;
        129.yy.yy.11;
    };
    forwarders {
        129.34.20.80;
        198.4.83.35;
        4.2.2.2;
        8.8.8.8;
    };
    allow-transfer {127.0.0.1; };
};


server 10.xx.xx.1 {
    transfer-format many-answers;
    transfers 10000;
};

server 129.yy.yy.10 {
    transfer-format many-answers;
    transfers 10000;
};

view "Internal" {
    match-clients { internal_hosts; !external_master; internal_master; };
    recursion yes;
    allow-recursion {internal_hosts;};
    allow-transfer { internal_master; };
    transfer-source 10.xx.xx.2;
    allow-notify {10.xx.xx.1;};

    zone "64.2.10.in-addr.arpa" {
        type slave;
        masters {10.xx.xx.1;};
        allow-transfer {internal_master;};
        allow-update {internal_master;};
        file "/var/named/slaves/10.2.64.Internal.rev";
    };


view "External" {
    allow-transfer {external_master;};
    allow-notify {129.yy.yy.10;};
    transfer-source 129.yy.yy.11;
    match-clients {!internal_master; external_master; internal_hosts; any;};
    recursion no;

    zone "50.146.204.in-addr.arpa" {
        type slave;
        masters {129.yy.yy.10;};
        allow-transfer {external_master;};
        allow-update {external_master;};
        file "/var/named/slaves/204.146.50.External.rev";
    };

Here is an output from my /var/log/messages requested about the DIG to my Master. The DIG for brsbld.ihost.com is the one in the External view that failed, whereas the DIG for bldbcrs.net is in the Internal view and goes through fine.

Apr 17 09:32:31 bbridns01 named[1717]: client 10.101.8.2#55756: view Internal: transfer of 'bldbcrs.net/IN': AXFR started
Apr 17 09:32:31 bbridns01 named[1717]: client 10.101.8.2#55756: view Internal: transfer of 'bldbcrs.net/IN': AXFR started
Apr 17 09:32:31 bbridns01 named[1717]: client 10.101.8.2#55756: view Internal: transfer of 'bldbcrs.net/IN': AXFR ended
Apr 17 09:32:31 bbridns01 named[1717]: client 10.101.8.2#55756: view Internal: transfer of 'bldbcrs.net/IN': AXFR ended
Apr 17 09:32:56 bbridns01 named[1717]: client 129.42.206.11#41783: view Internal: bad zone transfer request: 'brsbld.ihost.com/IN': non-authoritative zone (NOTAUTH)
Apr 17 09:32:56 bbridns01 named[1717]: client 129.42.206.11#41783: view Internal: bad zone transfer request: 'brsbld.ihost.com/IN': non-authoritative zone (NOTAUTH)
Improve this question
13
  • I have reindented your config files and found out that there are missing braces at the end of your views. (This way yor External view is inside your Internal view) Can you please confirm that it is that way on the server as well (not lost in copy/pasting)?
    – Fox
    Apr 17, 2015 at 13:54
  • If you want useful answers, try to make the task of the answering people as easy as you can. Now here is a downvote to motivate you in this direction. After a fix I will change this to up.
    – peterh
    Apr 17, 2015 at 14:01
  • @Fox thank you for fixing that. That was my mistake in copy pasting the information. I only used one zone as an example because I have around a 100 zones in my actual file.
    – Karl Keim
    Apr 17, 2015 at 15:09
  • The AXFR error you posted is for 43.96.32.in-addr.arpa and i don't see that in the zone declaration you posted, can you post that part also? Please check the logs on the master related to the AXFR from the secondary.
    – Daniel t.
    Apr 17, 2015 at 15:13
  • 1
    Please update the example to include the zone configs for the zones mentioned in /var/log/messages. As it stands this looks like the server thinks that the internal view is getting a zone transfer request for brsbld.ihost.com, and it thinks the internal view does not contain a type master or type slave statement for that zone. This suggests that either the config is wrong, or the request is coming in on the wrong view.
    – Andrew B
    Apr 17, 2015 at 15:54

2 Answers 2

Reset to default
2

He guys just wanted to update this to let you know what I found out for the solution. Under my Internal view the match-clients argument was messing me up.

match-clients { internal_hosts; !external_slave; internal_slave; };

The internal_hosts acl includes the range 129.42.0.0/16. This was listed before the !external_slave; argument so it was picking that up first because the slave server is 129.42.206.11 and putting it into the internal view. I rearranged it so that it excludes the external_slave first then it was properly being picked up by the external view. 

match-clients { !external_slave; internal_hosts; internal_slave; };
Improve this answer
0

My guess this line in your master config options is preventing the others from getting the zones: 

allow-transfer {127.0.0.1; };

I'd try removing that line or updating it to include your external_master.

Perhaps it's because you have multiple views in your config, the default view is getting that limited allow-transfer directive from options.
http://docs.freebsd.org/doc/8.3-RELEASE/usr/share/doc/bind9/arm/Bv9ARM.ch06.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .