BIND9 in a private VPN

Question

Lets say there is a private VPN (examplevpn.org) and there are several internal NETWORKS connected to it (net1.examplevpn.org, net2.examplevpn.org, and so on).

1. All mail goes through a relay in examplevpn.org (incoming or outgoing). All networks have their own mail servers.
2. All web access goes through a proxy server in examplevpn.org. There is no NAT, only that web proxy.
3. examplevpn.org have two DNS, one external, one internal. The internal one is only reachable from inside the VPN and only reply queries for *.examplevpn.org domains, the rest are ignored.
4. every internal network have its own DNS server.

I work in net1.examplevpn.org and I want to configure BIND (ver 9.9.5) to

1. Reply queries to *.net1.examplevpn.org directly. (EASY, zones, I'm stating this requirement for completion)
2. Forward *.examplevpn.org queries to the internal examplevpn.org DNS server. All of these are recursive queries.
3. IGNORE THE REST OF THE QUERIES to the rest of the internet, I mean, I DO NOT WANT THESE QUERIES FORWARDED TO THE INTERNAL examplevpn.org DNS server. The internal DNS server of examplevpn.org already ignores them and besides, as there is no NAT, I can't connect to the IP.

It's the combination of 2 and 3 that I don't know how to do AT THE SAME TIME.

I want to do 3 for two reasons:

• It's wasted bandwidth for no reason (the queries will fail anyway)
• Latency. I want the query to fail quickly. I oversimplified the problem. IRL there are 3 internal DNS, and my DNS server (at net1.examplevpn.org) tries the three of them before failing... It takes 5 secs most of the time one thing that should be instantaneous.

Answer 1

The solution is quite simple, if a bit obscure, but the forward directive is valid within a zone clause as well.

So disable any existing forwarders and recursion (requirement #3) , define a local zone (requirement #1) and forward everything for another specific zone to another name server (requirement #2) and you get something along the lines of:

options {
        recursion no;
        ...
};

zone "net1.example.org." IN {
        type master;
        file "zone.net1.example.org";
};
zone "example.org." IN {
        type forward;
        forward only;
        forwarders { 10.9.8.7; };
};