I am trying to setup a whitelisted domain forwarder in my bind9 but it wasn't successfully accomplish maybe due to the configuration that I applied.
A couple months ago, I did setup the same conceptual DNS with multiple views in Bind9 and it works perfectly as expected.
Now what's happening:- (The view is config. to forward gmail.com only) Whenever clients from 172.22.172.32/27 queries other than gmail.com domain, the DNS is still able to resolved the IP for the clients which expected/supposed to be failed.
Is there any good solution or any tweaks that have to be done in my current configuration?
Bind Version : 9.9.5
named.conf
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
view "wifi-test" {
match-clients {
172.22.172.32/27;
};
zone "gmail.com" {
type forward;
forward only;
forwarders {
1.1.1.1;
};
};
//include "/etc/bind/named.conf.default-zones";
recursion yes;
};
named.conf.options
options {
directory "/var/cache/bind";
// Accept request
allow-query-cache { 172.22.172.32/27; };
allow-query { 172.22.172.32/27; };
//allow-recursion { servers; };
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
//forward only;
//forwarders {
// 8.8.8.8;
// };
//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys. See https://www.isc.org/bind-keys
//========================================================================
// DNSSEC
dnssec-validation auto;
//dnssec-enable yes;
//dnssec-lookaside auto;
//key-directory "/etc/bind/keys";
#fetch-glue no;
recursion no;
auth-nxdomain no; # conform to RFC1035
listen-on-v6 { none; };
//listen-on port 53 { localhost; 172.22.172.41; };
// Exchange port between DNS Servers
//query-source address * port *;
// From 9.9.5 ARM, disables interface scanning to prevent unwanted stop listening
//interface-interval 0;
// Version
version "SecDNS";
//bindkeys-file "/etc/bind/bind.keys";
};
named.conf.local
// Manage the file logs
include "/etc/bind/named.conf.log";
Query Logs
queries: info: client 172.22.172.48#59842 (gmail.com.mytd.com): view wifi-test: query: gmail.com.mytd.com IN A + (172.22.172.41)
queries: info: client 172.22.172.48#59843 (gmail.com.mytd.com): view wifi-test: query: gmail.com.mytd.com IN AAAA + (172.22.172.41)
queries: info: client 172.22.172.48#59844 (gmail.com): view wifi-test: query: gmail.com IN A + (172.22.172.41)
queries: info: client 172.22.172.48#59845 (gmail.com): view wifi-test: query: gmail.com IN AAAA + (172.22.172.41)
queries: info: client 172.22.172.48#53702 (www.forum.com.mytd.com): view wifi-test: query: www.forum.com.mytd.com IN A + (172.22.172.41)
queries: info: client 172.22.172.48#53703 (www.forum.com.mytd.com): view wifi-test: query: www.forum.com.mytd.com IN AAAA + (172.22.172.41)
queries: info: client 172.22.172.48#53704 (www.forum.com): view wifi-test: query: www.forum.com IN A + (172.22.172.41)
queries: info: client 172.22.172.48#53705 (www.forum.com): view wifi-test: query: www.forum.com IN AAAA + (172.22.172.41)