1

I am trying to setup a whitelisted domain forwarder in my bind9 but it wasn't successfully accomplish maybe due to the configuration that I applied.

A couple months ago, I did setup the same conceptual DNS with multiple views in Bind9 and it works perfectly as expected.

Now what's happening:- (The view is config. to forward gmail.com only) Whenever clients from 172.22.172.32/27 queries other than gmail.com domain, the DNS is still able to resolved the IP for the clients which expected/supposed to be failed.

Is there any good solution or any tweaks that have to be done in my current configuration?

Bind Version : 9.9.5

named.conf

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
view "wifi-test" {
        match-clients {
                172.22.172.32/27;
        };
                zone "gmail.com" {
                        type forward;
                        forward only;
                        forwarders {
                                1.1.1.1;
                        };
                };
        //include "/etc/bind/named.conf.default-zones";
        recursion yes;
};

named.conf.options

options {
        directory "/var/cache/bind";

        // Accept request
        allow-query-cache { 172.22.172.32/27; };
        allow-query { 172.22.172.32/27; };
        //allow-recursion { servers; };

        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

        //forward only;
        //forwarders {
        //      8.8.8.8;
        // };

        //========================================================================
        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        //========================================================================

        // DNSSEC
        dnssec-validation auto;
        //dnssec-enable yes;
        //dnssec-lookaside auto;

        //key-directory "/etc/bind/keys";

        #fetch-glue no;
        recursion no;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { none; };
        //listen-on port 53 { localhost; 172.22.172.41; };

        // Exchange port between DNS Servers
        //query-source address * port *;

        // From 9.9.5 ARM, disables interface scanning to prevent unwanted stop listening
        //interface-interval 0;

        // Version 
        version "SecDNS";

        //bindkeys-file "/etc/bind/bind.keys";

};

named.conf.local

// Manage the file logs
include "/etc/bind/named.conf.log";

Query Logs

queries: info: client 172.22.172.48#59842 (gmail.com.mytd.com): view wifi-test: query: gmail.com.mytd.com IN A + (172.22.172.41)
queries: info: client 172.22.172.48#59843 (gmail.com.mytd.com): view wifi-test: query: gmail.com.mytd.com IN AAAA + (172.22.172.41)
queries: info: client 172.22.172.48#59844 (gmail.com): view wifi-test: query: gmail.com IN A + (172.22.172.41)
queries: info: client 172.22.172.48#59845 (gmail.com): view wifi-test: query: gmail.com IN AAAA + (172.22.172.41)

queries: info: client 172.22.172.48#53702 (www.forum.com.mytd.com): view wifi-test: query: www.forum.com.mytd.com IN A + (172.22.172.41)
queries: info: client 172.22.172.48#53703 (www.forum.com.mytd.com): view wifi-test: query: www.forum.com.mytd.com IN AAAA + (172.22.172.41)
queries: info: client 172.22.172.48#53704 (www.forum.com): view wifi-test: query: www.forum.com IN A + (172.22.172.41)
queries: info: client 172.22.172.48#53705 (www.forum.com): view wifi-test: query: www.forum.com IN AAAA + (172.22.172.41)

1 Answer 1

0

I found the solution! Well it's all about dnssec-validation which I forced to choose yes instead of auto or no.

view "Test" {
        match-clients { 172.22.172.32/27; };
        minimal-responses yes;     
        include "/etc/bind/named.conf.local"; #Whitelist Domains
        include "/etc/bind/zones/hostedzones"; #Zones Files

        forward only;
        forwarders { 0.0.0.0; };
        recursion yes;
}; 

view "Others" {
        match-clients { any; };

        minimal-responses yes;

        include "/etc/bind/named.conf.local"; #Whitelist Domains
        include "/etc/bind/zones/hostedzones"; #Zones files 

        forward only;
        forwarders {};
        recursion yes;
};

Basically, here the configuration is allowing "Others" to query any domains where else, "Test" is only allow to query whatever are in include files and forwarders { 0.0.0.0; }; Other queries forwarders will to try forward to 0.0.0.0 & will end-up with connection refused resolving.

Note : In "named.conf.local" are all forward zones.

I also upgrade to Bind version 9.10.3.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.