0

I'm running Bind on OpenWrt 15.05.1 as DNS server. I wanted to set up multiple view, with different zones.

acl "trusted" {
        10.0.1.0/24;
        localhost;
        localnets;
};

acl "blacklisted" {
        10.0.1.10;
};

options {
        directory "/tmp";
        recursion yes;
        allow-recursion { trusted; };
        allow-transfer { none; };
        dnssec-validation auto;
        forwarders {
                8.8.8.8;
        };
        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
};

view "blacklist" {
        match-clients { blacklisted; };
        zone "example.com" { type master; file "/etc/bind/zones/db.example"; };
};

view "normal" {
        match-clients { any; };
        zone "." {
                type hint;
                file "/etc/bind/db.root";
        };
};

And it works well, but only if the IP address in "blacklisted" acl has a subnet at its end (like that: 10.0.1.10/28). But I'm trying to target only one IP, which is not working for some reason.

Thanks for replies.

9
  • Can you be more specific about how it doesn't work? Also, what address is 10.0.1.10 in this context? Based on how you use it with match-destinations I gather it must be one of the addresses of the nameserver? Commented Jan 24, 2017 at 22:03
  • I don't know of openwrt binds all interfaces, you might want to make sure you're only recursive internally Commented Jan 24, 2017 at 22:11
  • you can also use match-client in the zone config Commented Jan 24, 2017 at 22:12
  • @PepinCZ Please confirm what the actual intention of using match-destinations was. If the solution is to change the client address matching it seems that maybe you meant to use match-clients all along? (Which may make for a more straightforward solution) Commented Jan 24, 2017 at 22:20
  • @HåkanLindqvist in this scenario match-clients was ment to be there. I just wrote it as an example (because the question was about Bing ignoring the "blacklist" view).
    – user319725
    Commented Jan 24, 2017 at 22:24

3 Answers 3

0

update { any; } sections with

{ !blacklisted; any; } in your normal view

9
  • This is not what I want. I just want to serve different zone files to "blacklisted". And /32 subnet doesn't work neither. But /28, for example, work perfectly how I want.
    – user319725
    Commented Jan 24, 2017 at 21:57
  • list the zone in both views if you need it in both views, clients only go into one view Commented Jan 24, 2017 at 21:58
  • that isn't the problem. If I use /28 subnet (10.0.1.10/28), it works as expected. But when I just enter the IP or /32, the "blacklist" view just gets ignored for some reason.
    – user319725
    Commented Jan 24, 2017 at 22:00
  • updated, sorry wrong bracket section Commented Jan 24, 2017 at 22:02
  • 1
    Amazing! Thanks! Now it works exactly as I wanted! Thank you so much. But I'm still curious why it requires that thought...
    – user319725
    Commented Jan 24, 2017 at 22:06
0

UPDATE:

You can specify single IP addrs.

IE

acl "someips" {
  10.0.0.1; 192.168.23.1; 192.168.23.15;
};

See this

1
  • I actually tried that, but it has the same effect as without /32. It just doesn't work.
    – user319725
    Commented Jan 24, 2017 at 21:55
-1

for single ip in ACL, you can add /32 e.g 10.0.1.10/32

1
  • 3
    OP mentioned this doesn't work for him.
    – Sven
    Commented Jul 31, 2019 at 7:42

You must log in to answer this question.