1

i've a problem with views using Bind9. I've a Microsoft DNS server with a domain "example.com" configurated to delegate the sub-domain "ds.example.com" to Bind DNS Server.

In the Bind server i've configured two view based on the match-client for two subnet 10.10.10.0 and 10.10.21.1. The problem is that client make dns query to Microsoft DNS server that recursively recall the Bind server, so the match-client match the IP of the Microsoft DNS server and not the IP of the client originating the query.

There a solution? Here the fragment of named.conf interested. Thanks!

view "Net10View" {
    match-clients { Net10; };
    allow-recursion { Net10; };
    allow-transfer { Net10; };
    zone "ds.terracina.local" {
            type master;
            file "net10.terracina.local.dns";
    };
};

view "Net21View" {
    match-clients { Net21; };
    allow-recursion { Net21; };
    allow-transfer { Net21; };
    zone "ds.terracina.local" {
            type master;
            file "net21.terracina.local.dns";
    };
};
0

It sounds like your Microsoft DNS server is operating in both an authoritative and a recursive role. In an authoritative role a nameserver would only provide a referral to ds.example.com., but if the client is allowed to recurse the server will chase the NS record referral and provide the requested answer.

If this is an internet facing MS DNS nameserver, I would recommend turning off recursion. If other servers rely on this recursion, spin up additional servers so that your recursive and authoritative roles are not shared by the same IP addresses.

  • But if i disable recursion, then client cannot resolve internet addresses? I've no chance to create additional DNS server. – Bartok Dec 18 '14 at 14:00
  • Mixing authoritative and recursive roles on an internet facing nameserver is against best practices. If it's not internet facing, you're still stuck. Not much in the way of alternatives here -- if you don't want recursive behavior, don't run a recursive server. – Andrew B Dec 18 '14 at 14:36
  • I've not understand if the bind view functionality are able to match the client ip if the request is forwarded by another DNS server – Bartok Dec 18 '14 at 15:18
  • It is not. Views are only useful if the BIND server is being used as a recursive DNS server, or if you need to respond differently to different authoritative DNS servers. If that is what you are trying to do, it will not work. – Andrew B Dec 18 '14 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.