forwarders and resolv.conf

[Kevin Darcy]

Rick Francis wrote:

> if your only resolver to the internet is a client (firewall that runs
> resolv.conf containing only external nameservers); your internal dns
> can/cannot use a forwarders directive to the firewall to resolve external
> hostnames? the answer is no; or is there is some other way?

The general answer is: have the internal nameservers forward to another
nameserver which has full connectivity to the Internet DNS. This could
either be a nameserver (or nameserver instance) running on your firewall, or
if you have a "packet-filtering" kind of firewall, a machine in your DMZ or
off-site which is selectively allowed to be queried from your intranet.


- Kevin