1

I am trying to setup a whitelisted domain forwarder in my bind9 but it wasn't successfully accomplish maybe due to the configuration that I applied.

A couple months ago, I did setup the same conceptual DNS with multiple views in Bind9 and it works perfectly as expected.

Now what's happening:- (The view is config. to forward gmail.com only) Whenever clients from 172.22.172.32/27 queries other than gmail.com domain, the DNS is still able to resolved the IP for the clients which expected/supposed to be failed.

Is there any good solution or any tweaks that have to be done in my current configuration?

Bind Version : 9.9.5

named.conf

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
view "wifi-test" {
        match-clients {
                172.22.172.32/27;
        };
                zone "gmail.com" {
                        type forward;
                        forward only;
                        forwarders {
                                1.1.1.1;
                        };
                };
        //include "/etc/bind/named.conf.default-zones";
        recursion yes;
};

named.conf.options

options {
        directory "/var/cache/bind";

        // Accept request
        allow-query-cache { 172.22.172.32/27; };
        allow-query { 172.22.172.32/27; };
        //allow-recursion { servers; };

        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

        //forward only;
        //forwarders {
        //      8.8.8.8;
        // };

        //========================================================================
        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        //========================================================================

        // DNSSEC
        dnssec-validation auto;
        //dnssec-enable yes;
        //dnssec-lookaside auto;

        //key-directory "/etc/bind/keys";

        #fetch-glue no;
        recursion no;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { none; };
        //listen-on port 53 { localhost; 172.22.172.41; };

        // Exchange port between DNS Servers
        //query-source address * port *;

        // From 9.9.5 ARM, disables interface scanning to prevent unwanted stop listening
        //interface-interval 0;

        // Version 
        version "SecDNS";

        //bindkeys-file "/etc/bind/bind.keys";

};

named.conf.local

// Manage the file logs
include "/etc/bind/named.conf.log";

Query Logs

queries: info: client 172.22.172.48#59842 (gmail.com.mytd.com): view wifi-test: query: gmail.com.mytd.com IN A + (172.22.172.41)
queries: info: client 172.22.172.48#59843 (gmail.com.mytd.com): view wifi-test: query: gmail.com.mytd.com IN AAAA + (172.22.172.41)
queries: info: client 172.22.172.48#59844 (gmail.com): view wifi-test: query: gmail.com IN A + (172.22.172.41)
queries: info: client 172.22.172.48#59845 (gmail.com): view wifi-test: query: gmail.com IN AAAA + (172.22.172.41)

queries: info: client 172.22.172.48#53702 (www.forum.com.mytd.com): view wifi-test: query: www.forum.com.mytd.com IN A + (172.22.172.41)
queries: info: client 172.22.172.48#53703 (www.forum.com.mytd.com): view wifi-test: query: www.forum.com.mytd.com IN AAAA + (172.22.172.41)
queries: info: client 172.22.172.48#53704 (www.forum.com): view wifi-test: query: www.forum.com IN A + (172.22.172.41)
queries: info: client 172.22.172.48#53705 (www.forum.com): view wifi-test: query: www.forum.com IN AAAA + (172.22.172.41)

1 Answer 1

0

I found the solution! Well it's all about dnssec-validation which I forced to choose yes instead of auto or no.

view "Test" {
        match-clients { 172.22.172.32/27; };
        minimal-responses yes;     
        include "/etc/bind/named.conf.local"; #Whitelist Domains
        include "/etc/bind/zones/hostedzones"; #Zones Files

        forward only;
        forwarders { 0.0.0.0; };
        recursion yes;
}; 

view "Others" {
        match-clients { any; };

        minimal-responses yes;

        include "/etc/bind/named.conf.local"; #Whitelist Domains
        include "/etc/bind/zones/hostedzones"; #Zones files 

        forward only;
        forwarders {};
        recursion yes;
};

Basically, here the configuration is allowing "Others" to query any domains where else, "Test" is only allow to query whatever are in include files and forwarders { 0.0.0.0; }; Other queries forwarders will to try forward to 0.0.0.0 & will end-up with connection refused resolving.

Note : In "named.conf.local" are all forward zones.

I also upgrade to Bind version 9.10.3.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .