Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For my particular setup, I've got control of a BIND 9 zone file for, say, There are several hosts in this zone, such as and I want the public internet to be able to query these hosts and retrieve their IPs as you'd expect.

Can some hosts be flagged as "private", in the sense that most public internet users can't query information about these hosts, except for a specific IP range of users? For example, can I make a third host, query-able only by users in the 192.168.0.x range?

I'm aware that I can do this with separate zones in BIND, but this doesn't seem to offer what I need. The key here is that both the public and private hosts need to be part of the same parent, in this case. This could also be achieved by the /etc/hosts file on the few privy machines, but then the records would not be centrally manageable.

Is this possible, or am I overlooking a different solution?

share|improve this question
up vote 8 down vote accepted

Yes, Bind does this with views. Some in detailed examples are here and here.

It would look something like this in named.conf:

view "trusted" {
 match-clients {; }; // our network
  recursion yes;
  zone "" {
   type master;
   // private zone file including local hosts
   file "internal/";
  // add required zones
view "badguys" {
 match-clients {"any"; }; // all others hosts
 // recursion not supported
 recursion no;
 zone "" {
   type master;
   // public only hosts
   file "external/";
  // add required zones

One trick I typically do to make administration easier is to simply have the internal file $INCLUDE the external file -- just don't forget about SOAs.

As a final word of caution, don't pretend this is anything more than Rubber Chicken Security (not that there's anything wrong with that).

share|improve this answer
This is perfect! Now I just need to read up on how to get this to properly transfer to slave servers. – Collin Allen Sep 30 '09 at 19:58
I should mention that I got BIND views working perfectly, complete with zone transfers to slaves. The biggest hangup for me was discovering that slaves required a second IP each to retrieve the zones for each view. – Collin Allen Dec 13 '09 at 6:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.