0

Successfully configured Bind to host multiple views with TSIG with this guide. Problem is when I add a third view to the mix, things get weird.

On each server, I have 3 views right now:

  • USA
  • Europe
  • China

The second I add the China view, the slave server uses the Europe view when it should be using the China view. When I query the master server from a China host, it uses the correct view. I've verified keys on both servers and although my slave server would geoip match to the Europe view, I've removed the geoip statement from the Europe view just to make sure and it still does it.

ACL's on both servers:

acl "USA" {
    key usa-key;
    !key europe-key;
    !key china-key;
    geoip country US;
};

acl "Europe" {
    key europe-key;
    !key usa-key;
    !key china-key;
    geoip country NO;
};

acl "China" {
    key china-key;
    !key usa-key;
    !key europe-key;
    geoip country CN;
};

Master:

view "USA" {
    match-clients { USA; };
    allow-transfer { key usa-key; };
    zone "domain.net." {
        type master;
        also-notify { $slave_server key usa-key; };
        file "/etc/bind/domain.net/na.domain.net.zone";
    };
    zone "3.2.1.in-addr.arpa." {
        type master;
        also-notify { $slave_server key usa-key; };
        file "/etc/bind/domain.net/na.domain.net.rev";
    };
    zone "doma.net." {
        type master;
        also-notify { $slave_server key usa-key; };
        file "/etc/bind/domain.net/na.doma.net.zone";
    };
    zone "9.8.7.in-addr.arpa." {
        type master;
        also-notify { $slave_server key usa-key; };
        file "/etc/bind/domain.net/na.doma.net.rev";
    };
};

view "Europe" {
    match-clients { Europe; };
    allow-transfer { key europe-key; };
    zone "domain.net." {
        type master;
        also-notify { $slave_server key europe-key; };
        file "/etc/bind/domain.net/eu.domain.net.zone";
    };
    zone "3.2.1.in-addr.arpa." {
        type master;
        also-notify { $slave_server key europe-key; };
        file "/etc/bind/domain.net/eu.domain.net.rev";
    };
    zone "doma.net." {
        type master;
        also-notify { $slave_server key europe-key; };
        file "/etc/bind/domain.net/eu.doma.net.zone";
    };
    zone "9.8.7.in-addr.arpa." {
        type master;
        also-notify { $slave_server key europe-key; };
        file "/etc/bind/domain.net/eu.doma.net.rev";
    };
};

view "China" {
    match-clients { China; };
    allow-transfer { key china-key; };
    zone "domain.net." {
        type master;
        also-notify { $slave_server key china-key; };
        file "/etc/bind/domain.net/cn.domain.net.zone";
    };
    zone "3.2.1.in-addr.arpa." {
        type master;
        also-notify { $slave_server key china-key; };
        file "/etc/bind/domain.net/cn.domain.net.rev";
    };
    zone "doma.net." {
        type master;
        also-notify { $slave_server key china-key; };
        file "/etc/bind/domain.net/cn.doma.net.zone";
    };
    zone "9.8.7.in-addr.arpa." {
        type master;
        also-notify { $slave_server key china-key; };
        file "/etc/bind/domain.net/cn.doma.net.rev";
    };
};

Slave:

view "USA" {
    match-clients { USA; };
    zone "domain.net." {
        type slave;
        masters { $master_server key usa-key; };
        file "/var/lib/bind/na.domain.net.zone";
    };
    zone "3.2.1.in-addr.arpa." {
        type slave;
        masters { $master_server key usa-key; };
        file "/var/lib/bind/na.domain.net.rev";
    };
    zone "doma.net." {
        type slave;
        masters { $master_server key usa-key; };
        file "/var/lib/bind/na.doma.net.zone";
    };
    zone "9.8.7.in-addr.arpa." {
        type slave;
        masters { $master_server key usa-key; };
        file "/var/lib/bind/na.doma.net.rev";
    };
};

view "Europe" {
    zone "domain.net." {
        type slave;
        masters { $master_server key europe-key; };
        file "/var/lib/bind/eu.domain.net.zone";
    };
    zone "3.2.1.in-addr.arpa." {
        type slave;
        masters { $master_server key europe-key; };
        file "/var/lib/bind/eu.domain.net.rev";
    };
    zone "doma.net." {
        type slave;
        masters { $master_server key europe-key; };
        file "/var/lib/bind/eu.doma.net.zone";
    };
    zone "9.8.7.in-addr.arpa." {
        type slave;
        masters { $master_server key europe-key; };
        file "/var/lib/bind/eu.doma.net.rev";
    };
};

view "China" {
    zone "domain.net." {
        type slave;
        masters { $master_server key china-key; };
        file "/var/lib/bind/ch.domain.net.zone";
    };
    zone "3.2.1.in-addr.arpa." {
        type slave;
        masters { $master_server key china-key; };
        file "/var/lib/bind/ch.domain.net.rev";
    };
    zone "doma.net." {
        type slave;
        masters { $master_server key china-key; };
        file "/var/lib/bind/ch.doma.net.zone";
    };
    zone "9.8.7.in-addr.arpa." {
        type slave;
        masters { $master_server key china-key; };
        file "/var/lib/bind/ch.doma.net.rev";
    };
};

Thoroughly out of ideas. If anyone knows of what I'm doing wrong, I'd greatly appreciate a response.

1 Answer 1

2

In the slave configuration the match-clients directives are missing in your Europe and China views.

Based on the way views work (first matching view is used), all queries that did not match your USA view (which has its match-clients directive), everything else will go into the next view (your Europe view, which matches anything) and nothing to the last view (your China view, which would also match anything, just that there are no unmatched queries left at that point).

Worth noting, you probably want something to be the catch-all. Ie, if a query does not match any of the countries, you probably still want a proper response?

3
  • Additionally "Europe" acl is using geoip country NO which likely is not covering whole Europe. Catch-all clause is likely very good idea as world is a big bigger then the three regions covered.
    – Tomek
    Sep 9, 2018 at 17:08
  • I have NO for testing :)
    – emdk
    Sep 9, 2018 at 18:37
  • I can't believe I missed that!!!!!!!!! I need to re-organize that with include statements for common zone information and yes, you're right, I need to include a catchall. If I told you I banged my head into a desk because of missing that, would you believe me? Buy yourself a good brew for helping this idiot out!
    – emdk
    Sep 9, 2018 at 18:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .