Howdy all,

This may not be an intelligent question, but here we go. My firewall (Linux machine with three interfaces running iptables) does my DNS and DHCP. The three interfaces are as follows:

1) External - connects to my cable modem
2) Internal - connects to the private network
3) DMZ - connects to an untrusted wireless network

The DMZ interface is basically treated just like the internet. It cannot directly connect to any internal IP address. Therefore, it has to connect to the DMZ interface IP address, which will then NAT to the appropriate internal interface. Because of this, I need completely different DNS resolution on the DMZ than on the internal network.

So, to make a long story short (too late), is there a way to have named reference different zone files when the requests originate from a particular interface? If not, can I run two instances of named, one listening on the internal interface and one listening on the DMZ interface?


Thanks in advance!

Yes, this known as a split-view DNS configuration. Using the access lists of BIND9, you can setup different views, one internal and one external, which will pull information from different zone files and return answers based on the source address for the query. I use this on my own Linux firewalls.