Puzzling scenario involving views
Peter Rabbitson
rabbit at rabbit.us
Tue Aug 17 01:35:39 UTC 2004
Hello list,
I have a bind9 serving the domain example.com, with a secondary backup dns
(secondary.com) at a remote location. I wanted to achieve redundancy of
both domains provided to each other (example.com has secondary.com as
2nd NS, and vice versa), and at the same time I wanted to define internal
and external views in example.com for internal network naming purposes. I
got it working fairly quick with the example below, however here is my
problem: members of the insiders acl would not receive an AA answer when
inquiring about secondary.com. I was thinking that views are not terminating
and "insiders" would see both the internal and external view at the same
time. If however this is not the case - how do I place secondary.com in
both views without breaking AXFRs? Can I specify a slave zone reference to
the same zone file and then explicitly allow-notify { none; }; in the
internal slave zone statement? Or is there another approach that I can not
think of?
acl "insiders" {
192.168.0.0/24;
127.0.0.1;
};
acl "secondary" {
xxx.xxx.xxx.xxx;
};
view "internal" {
match-clients { insiders; };
zone "." {
type hint;
file "db.root";
};
zone "example.com" {
type master;
file "example-int.com";
allow-query { insiders; };
};
zone "0.168.192.in-addr.arpa" {
type master;
file "example-int.rev";
allow-query { insiders; };
};
};
view "external" {
match-clients { any; };
zone "." {
type hint;
file "db.root";
};
zone "example.com" {
type master;
file "example-ext.com";
allow-transfer { secondary; };
};
zone "secondary.com" {
type slave;
file "slave.secondary.com";
masters { xxx.xxx.xxx.xxx; };
};
zone "com" { type delegation-only; };
zone "net" { type delegation-only; };
};
Thanks
Peter
More information about the bind-users
mailing list