Can i include file in bind acl {} directive? I need to include 1800+ ip prefixes into acl for directing their traffic to specific server using bind. I want to put those prefixes into a file and include it into acl. Like following

acl "caching" {
inlcude "/etc/prefixes"
};
But it gives the following error and bind doesn't start :-

Error in named configuration:
/etc/named.conf:45: missing ';' before '"'

FILE :-

/etc/prefixes :-

1.1.1.1/8;
10.2.5.1/24;

You can't

What you can do, if you don't want to bloat named.conf with the 1800+ IPs, is to create the file /etc/prefixes containing the the acl name and the 1800+ IPs, like:
and use that acl inside another acl in named.conf:
...
Regards

@bathody thanks. I have configured the acl, i have another issue now.I am trying to configure master/slave bind with view directives. I have two VIEW directives for same zone, one for local ISP clients(INTERNAL) and other for EXTERNAL(ANY REQUESTS). Slave is fetching the zones from master, but both internal and external zones contain the same contents (the contents of EXTERNAL). Following is the configuration on master/slave :-

MASTER :-

view "tw" {
match-clients { tw; };
zone "files.com" {
type master;
file "tw.com.db";
};

zone "." IN {
type hint;
file "named.ca";
};

include "/etc/named.rfc1912.zones";


};

view "external" {
match-clients { any; };

zone "files.com" {
type master;
file "files.com.db";
};

zone "." IN {
type hint;
file "named.ca";
};

include "/etc/named.rfc1912.zones";



};


include "/var/named/tw-prefixes";

acl "tw" {
caching;
};




options {
listen-on port 53 { 192.123.42.81; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
// allow-query-cache { none; };
allow-transfer {192.123.42.84;};
recursion no;


SLAVE :-

view "tw" {
match-clients { tw; };

allow-query { any; };
zone "files.com" {
type slave;
masters {192.123.42.81;};
file "slaves/tw.com.db";
};

zone "." IN {
type hint;
file "named.ca";
};

include "/etc/named.rfc1912.zones";



};

view "external" {
match-clients { any; };
allow-query { any; };
zone "files.com" {
type slave;
masters {192.123.42.81;};
file "slaves/files.com.db";
};

zone "." IN {
type hint;
file "named.ca";
};

include "/etc/named.rfc1912.zones";



};


include "/var/named/tw-prefixes";

acl "tw" {
caching;
};





options {
listen-on port 53 { 192.123.42.84; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
// allow-query-cache { none; };
recursion no;

Hi.

I've answered your other post here.
Please don't cross-post.

1 members found this post helpful.

Yes bathory, i am sorry for it. I've fixed it. I'll be careful next time.

@Bathody, my DNS is live now. I have added my local client machine's public ip in bind caching acl to route my client's ip to specific server. Now when i ping to the domain. It doesn't resolve into any ip and /var/log/messages show the following ip instead my modem's ip is 39.2.4.32.

Jul 10 01:42:41 dns named[812]: client 182.190.0.21#35126: view external: query (cache) 'domain.files.com/A/IN' denied


it is trying to resolve my ip to the external zone. Why the ip is wrong in logs? There should be my modem's ip.

view "tw" {
match-clients { caching; };
zone "files.com" {
type master;
file "files.com.tw";
};

zone "." IN {
type hint;
file "named.ca";
};

include "/etc/named.rfc1912.zones";



};

acl "caching" {
39.0.0.0/8;

};


options {
listen-on port 53 { 210.22.172.81; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
allow-query-cache { none; };


I am not getting the issue here. :-(

Regards.

I don't know. It's clearly a networking issue. Using that IP it falls into external view, so it denies query.
You can add that IP (or subnet) in the caching ACL, so it works as expected.

This is the problem http://backreference.org/2010/02/01/...dns-with-bind/

Note that our DNS server will almost never be queried directly by the end clients that need to access the service; rather, it will be queried by other DNS servers that want to resolve the names on behalf of their clients. However, it's reasonable to assume that end clients will generally be using DNS servers that are geographically close to them (for example, their company's or their ISP's DNS). Sure, there will be exceptions, but the worst that can happen is that, say, an asian client is sent to the european server, for example, so it's not really something to worry about, and geoIP information cannot be 100% accurate anyway, so those things would probably happen in any case.

I am trying to route public ips towards the acl rather it should be DNS servers.

What problem? If you're trying to implement geoIP, follow the instructions and you'll be ok.

Well, i am not sure to call it GEOIP. Maybe, you can call it ISP based caching. Because, we only need to route those ip prefixes towards the local caching server(located in ISP) which are provided by our ISP(located in local country) and route the rest to the main servers located in U.S. Can bind work with 2000+ ip Prefixes ? We need to route requests coming from 2000+ ip prefixes CIDR notations using bind VIEW clause towards the local caching server's ip.

I don't think that there should be a problem, given that you have enough memory available.
Bind loads everything in memory when it starts, so those 2000+ ips could consume a lot of RAM

When i remove or add some ip prefix into the file which is included in acl {}. The changes doesn't occur instead i have to reboot the openvz container 3~4 times in order for changing to take effect. What could be the issue, rndc flush, rndc reload etc are not helping here.

@bathody, that is the exact problem i am having :-

http://www.linuxquestions.org/questi...ip-4175496376/

D'oh, I cannot understand your problem. If I configure the google dns (8.8.8.8) as my resolver, you'll see the query coming from it when I'll try to resolve your domain

you're right. Is there a way i can overcome this problem ? We need to cache videos on our local caching server in ISP. Only way i know, is to route requests coming from ISP ip prefixes towards the local caching server.

Do you have better solution for caching ? I can't use geoip caching cause its on region/country base. Our ISP doesn't allow any other ip to watch the cached content from their caching Server. So i need to be more specific for caching.a