2

I have two secondary DNS servers for a zone. One of these servers, when receiving a request from a specific range should modify one of the records.

In order to split the answer, I am planning to use a view:

acl dmz { 192.168.0.0/24; localhost; };
acl lan { 10.0.0.0/8; };

view dmz {
  match-clients { dmz; };
  zone "example.info" {
    type slave;
    masters { 10.100.10.254; };
    file "/etc/bind/db.example-dmz.info";
  };

};

view lan {
  match-clients { lan; };
  zone "example.info" {
    type slave;
    masters { 10.100.10.254; };
    file "/etc/bind/db.example-lan.info";
  };

};

The configuration above splits the answers, but the answers are the same.

I would like, when device 192.168.0.10 (in dmz) requests the resolution of foo.example.info, to send back 192.168.0.20 instead of the answer from the transferred zone.

How to override this single entry?

3

Make that single slave name server the master for zone foo.example.info and only show it in the desired view, e.g.

view all-clients {
  match-clients { lan; !192.168.0.10/32; dmz; };
  zone "example.info" {
    type slave;
    masters { 10.100.10.254; };
    file "/var/bind/db.example.info";
  };
};

view exception-host {
  match-clients { 192.168.0.10; };
  zone "foo.example.info" {
    type master;
    file "/etc/bind/foo.example.info-for-192.168.0.10";
  };

  zone "example.info" {
    in-view all-clients;
  };
};

Now when the 192.168.0.10 requests a lookup, it'll see the "exception-host" view and get a different response for the record "foo.example.info". Otherwise, it gets the same results as all other clients doing a lookup.

| improve this answer | |
  • @WoJ: Did this work? – Tommiie Sep 4 '18 at 11:29
1

You're missing 'match-clients' statements in your views to indicate which acls are allowed to use the view. For example, you probably want something like:

view dmz {
  match-clients { dmz; };
  zone "example.info" {
    type slave;
    masters { 10.100.10.254; };
    file "/etc/bind/db.example-dmz.info";
  };

};

And a corresponding entry for the 'lan' view.

| improve this answer | |
  • Thanks for the catch, I will update my question (which was about how to override a single entry) – WoJ Aug 6 '18 at 11:11
  • Simply put your overriding entries in the db.example-dmz.info zone file on the master and reload the zone to push it out to your slaves. (don't forget to update the serial number) – Brandon Xavier Aug 6 '18 at 12:19
  • Sorry if I was not clear: I have a master DNS which provides zones to slaves. On one specific slave, for one specific view, I need to overwrite an entry from the master. Say the master is configured to resolve x.exampl.info to 10.10.10.10 - I want clients to see that except if they are coming from a specific network where that entry (x.example.com) needs to be resolved to something else (say 10.20.30.40). In other words, the slave gives its own answer for one host, despite receiving a zone from the master which includes this host. – WoJ Aug 6 '18 at 13:17
  • dnsmasq might do this. Just spin up a tiny VM in the DMZ, put your overrides in it's hosts files and point resolv.conf to your slaves. Then make sure your DMZ machines only point to the dnsmasq VM. It's an UGLY solution, but then again, the problem isn't very pretty either ;-) – Brandon Xavier Aug 6 '18 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.