Views configuration question.

[Kevin Darcy]

Tom Diehl wrote:

>Hi all,
>
>I have a couple of zones that I host. The master is on a local machine and the
>slave is hosted remotely. In addition I have zones that are locally hosted
>slaves and the masters are hosted remotely. Both nameservers have both internal
>and external views. The question is, what is the correct way to handle the
>internal view of the zones for which I am a slave? 
>
>For example if I have a config file that looks something like the following:
>
>view "rogueind" {
>    match-clients { "internal";};
>    recursion yes;
>
>zone "rogueind.com" in {
>        type master;
>        notify yes;
>        file "rogueind.com.internal.db";
>        allow-transfer {
>                "internal";
>                };
>    };
>
>}
>
>
>view "external" {
>    match-clients { "any"; };
>    recursion no;
>
>    zone "rogueind.com" in {
>        type master;
>        notify yes;
>        file "rogueind.com.db";
>        allow-transfer {
>                "external";
>                };
>    };
>
>	zone "stnhbr.com" in {
>        type slave; masters { xxx.xxx.xxx.xxx; };
>        notify no;
>        file "cache/stnhbr.com.db";
>        allow-transfer { "external"; };
>    };
>
>};
>
>What is the correct way to handle the internal view of the stnhbr.com domain?
>Do I do it the way I have it above? I think this would just query the remote
>nameserver but what happens if the remote is unavailable? 
>
As a recursive resolver, it will try to query any or all of the 
nameservers which are published in the zone's NS records, including your 
nameserver if it is published there.

>If I add a stanza 
>to the internal view for the stnhbr zone I do not think the zone transfers,
>notifies, etc will work properly given that the internal addresses will never
>match the external addresses.
>  
>
A question: do you have multiple addresses on this box, or just one? If 
you have just one address, then perhaps the simplest thing to do is make 
both views slaves of the stnhbr.com zone. This will incur some extra 
zone-transfer overhead, unfortunately. If you want to avoid that 
overhead, you could try adding an exception to the match-clients so that 
when the nameserver instance queries *itself*, it gets the external 
view. If you do that, though, you might want to change /etc/resolv.conf 
on the box to point to 127.0.0.1, otherwise local processes will lose 
the ability to resolve internal names.

If you have multiple addresses on the box to play with, you could tinker 
with query-source, transfer-source etc. to have the internal view be a 
stealth slave from the external view for stnhbr.com. Be aware, however, 
that whenever you make a slave to another slave, changes to the zone 
could take up to twice the refresh time to propagate.

- Kevin