This is a kind of extension to the previous thread I made about allowing a DNS publically resolving, as such (apologies for my lack of good english with this lol).

But thanks to the great people that replied to to, it's now working.

What the client is asking of me now is to be able to allow only local network (LAN) clients to resolv the hostnames of nodes on his network.

Using ACL's of course, I would just create 2 zones files wouldn't I?

So I would potentially have 2 zones files wouldnt i?

So there would be example.com.zones.internal (which would be wrapped inside the internal ACL, like a subnet of 192.168.0.0/24 as I believe I set it up as).

So only the local subnet can view this configuration, ie resolv host names.

Then setup the external so all the queries outside can only resolv his public names like www for example.

Am I thinking this through properly?

Thanks to those people again I was able to principly get this working its functioning now as he has tested his web server on this and it works, I am so impressed with myself that I understand more about DNS servers, even embarking on doing RDNC keys, but just having a problem thinking this through properly and would like to have anyones opinion on this.

I appreciate any reply in advance,
Jez.

It seems to me that you would have a DNS server on the LAN that could only be accessed by the local LAN clients.

If the DNS server is on a public facing interface then you could use iptables to restrict which computers could connect to the DNS server lookup daemon's port.

ACLs cannot work because they are for restricting access to files. The DNS server's daemon must be able to see all of the DNS files so the only other method available is to restrict access to the DNS service itself via iptables.

No I dont think your understanding what I am talking about.

A client of mine has a public DNS server right? People query from outside yes?

He wants though to be able to query it using his own lan node names on his network, is it possible to allow him to do this yet not allow the node names from outside?

Thats it, it has already been setup as a public facing dns, he just wants to allow his own network users to query hostnames, not the outside world though.

Where as records like www will be accessible inside and outside, and then node1.whateverdomain.com be accessible from just inside the local lan.

Thanks,
Jez.

I just discovered this web page that has an example of using an acl inside the BIND configuration files.

http://www.howtoforge.com/how-to-pat...-fedora-centos

I hope that helps.