[SOLVED] bind and views

frater · 12-28-2010, 07:48 AM

I have a working caching DNS-server using bind.
This setup is being used for years to respond to queries of our clients.

I want to give a certain IP or set of IP's another answer than the one that is given by the Authorative server. I have studied and experimented some with using different 'views'.
I was able to give that test IP a different one, but at the same time the others were not able to resolve that zone again.

I will use the zone 'smtp.mytoplevel.com' as example.

This is my config:

Code:

# grep -vE '^(\/\/|$)' named.conf
include "/etc/bind/named.conf.options";
zone "." {
        type hint;
        file "/etc/bind/db.root";
};
zone "local" {
        type master;
        file "/etc/bind/db.local";
};
zone "localhost" {
        type master;
        file "/etc/bind/db.localhost";
};
zone "127.in-addr.arpa" {
        type master;
        file "/etc/bind/db.127";
};
zone "0.in-addr.arpa" {
        type master;
        file "/etc/bind/db.0";
};
zone "255.in-addr.arpa" {
        type master;
        file "/etc/bind/db.255";
};
include "/etc/bind/named.conf.local";

Normally named.conf.local is empty, but I have this (not working) config.

Code:

view "badboy" {
   match-clients { 80.120.10.111/32; };
   zone "smtp.mytoplevel.com" {
      type master;
      file "/etc/bind/db.smtp.mytoplevel.com.fixed";
   };

}; // end view

zone "smtp.mytoplevel.com" {
  type master;
    file "/etc/bind/db.smtp.mytoplevel.com";
};

Somehow it's not working as expected. I also thought I would be allowed to leave out the default zone declaration, but then I had errors in my log.

Could someone who knows what I want to do and knows how he can do it help me?

bathory · 12-28-2010, 09:05 AM

Hi,

When using the "view" statement, all zones must be inside views. Meaning that you need to put the rest of the zones in another view. E.g:

Code:

view "badboy" {
   match-clients { 80.120.10.111/32; };
   zone "smtp.mytoplevel.com" {
      type master;
      file "/etc/bind/db.smtp.mytoplevel.com.fixed";
   };

}; // end view

view "goodboy" {
   match-clients { any;};

zone "smtp.mytoplevel.com" {
  type master;
    file "/etc/bind/db.smtp.mytoplevel.com";
    };
zone "." {
        type hint;
        file "/etc/bind/db.root";
        };
zone "local" {
        type master;
        file "/etc/bind/db.local";
        };
zone "localhost" {
        type master;
        file "/etc/bind/db.localhost";
        };
zone "127.in-addr.arpa" {
        type master;
        file "/etc/bind/db.127";
        };
zone "0.in-addr.arpa" {
        type master;
        file "/etc/bind/db.0";
        };
zone "255.in-addr.arpa" {
        type master;
        file "/etc/bind/db.255";
        };
};  // end view

Regards

frater · 12-28-2010, 11:36 AM

Aha,

Thank you, I will try that tomorrow.
I interpreted that message wrong... I thought I had to put all the zones I declared previously also inside the "badboy view".
Your post makes more sense. ;-)

Another question, before I try it.

Is it safe to omit the zone for which I want to have an exception in the "goodboy" view?

I would rather let the Authorative DNS-server deal with that request.
The Authorative DNS-server is under my control too, but I'd rather have the Authorative server authorative.
I merely want an exception for "badboy".

Cheers

bathory · 12-28-2010, 11:57 AM

Quote:

Is it safe to omit the zone for which I want to have an exception in the "goodboy" view?

But isn't this server the authoritative dns for the specific domain? Because you use "type master" in the zone definition.
If it isn't, sure you can omit it and it will be resolved by the real authoritative dns.

Regards

frater · 12-28-2010, 06:49 PM

Quote:

Originally Posted by bathory

But isn't this server the authoritative dns for the specific domain? Because you use "type master" in the zone definition.
If it isn't, sure you can omit it and it will be resolved by the real authoritative dns.

Regards

No, it's only a caching-DNS
When experimenting with the views I had it working for badboy, but it wasn't for the rest. I thought I needed to create a bind-file for the default too.

Will give feedback tomorrow!

frater · 12-29-2010, 06:56 AM

It's working!
Thanks....