I have a domain, I'll call it X in the post, that I am using htdig on to spider through the site and compile a search db. The problem is, htdig access the system through eth0, and I am trying to prevent this, I want it to connect locally but use the same FQDN. So I thought I could add an A entry in X's zone file refering it to 127.0.0.1, as well as add an entry to /etc/hosts which connects 127.0.0.1 to X, so here's what I have in both those files:

/var/named/X.hosts:

X. IN A yy.yy.yy.yy
X. IN A 127.0.0.1

/etc/hosts:

127.0.0.1 localhost
127.0.0.1 X
yy.yy.yy.yy ns1.X
yy.yy.yy.yy X

(Where yy.yy.yy.yy is the public IP.)

My hypothesis behind this is that htdig will now resolv X to 127.0.0.1, and not have to connect through the eth0 connection, just the lo device. Is this correct? Would this screw anything up as far as addressing goes, or resolving? Is there an easier way to do this? Thanks in advance!

Mike.

It will only work half the time because the BIND resolver will do round-robin.

how can I make this occur permanently? Would Iptables be the best bet?

You can try putting your new entry at the top of the /etc/hosts file (just 127... X) and /etc/hosts might take the first match (test it to make sure). I'm pretty certain that hosts resolution will just take first match and won't look for others. BIND will do round-robin no matter what, though so you might as well yank that stuff out of your zone file. Besides, if you're making that zone available to Internet client then you're going to cause them grief (half the time your site will resolve to the IP of the loopback adaptor so instead of your site, they'll get nothing).

You can also read up on BIND "views" to implemention split-horizon DNS. What that would do is give one IP to the outside world, but a different IP to a small set of hosts or networks that you define.

I think the best way to handle it will be iptables, what I did was added this nat rule:

iptables -t nat -A OUTPUT -d X -j DNAT --to-destination 127.0.0.1

that way it won't matter what the system resolves the DN as, when it tries to access the public IP it will be routed to lo. What do you think?

You'll break any service that you need to access on your machine that isn't also running on loopback.

Well, it looks like this kind of thing happens naturally anyways, I setup a logging on the packets accessing that interface from internally, and nothing is logged, so my guess is that it is translated automatically.

If you define it that way in /etc/hosts, then yes.