Using DNS servers to query root servers from WAN

[samankaya at netscape.net]

 Hmm.... many thanks Kevin for that!

What I am trying to establish is something more like an ISP DNS server set, of course they would probably be doing exactly what you suggested:

"If you want to allow a *limited* set of clients on the other side of 
your NAT to query Internet names, then add them to the "internal" view. 
Optionally, change the name of the "internal" view to something which 
more accurately reflects its intent, e.g. "trusted_ranges" or whatever. "


 
I don't know about the root dns servers themselves if they are provisioned like this but really it's just an open end experiment in my test lab.

I did include the root "." zone in the external view before which didn't work either so I guess if I can get that particular zone to work with any public IP address then I can later create a "trusted_wan" zone in which certain public IP addresses are accepted for recursive lookup for root servers.

For example if I added:

zone "." { 
type hint;?
file "/etc/opt/csw/bind/db.root";?
}; 

to both external and internal views would that work??

so if I did something more like this:

acl internals {?
127.0.0.0/8; 
192.168.0.0/22; 
};? 


include "/etc/opt/csw/bind/named.conf.options";?



// View for internal clients?



view "internal" {?


match-clients { internals; };?


allow-recursion {?                 192.168.0.0/22;?                 127.0.0.1;?                 }; 



// be authoritative for the localhost forward and reverse zones, and for?


// broadcast zones as per RFC 1912                                     
> 

zone "." { 

type hint;?
file "/etc/opt/csw/bind/db.root";?
};



zone "localhost" {?


type master;?


file "/etc/opt/csw/bind/db.local";?


};
? 


zone "127.in-addr.arpa" {?


type master;    
> //        file "/etc/opt/csw/bind/db.127";?


};
? 


zone "0.in-addr.arpa" {?


type master;  
> //        file "/etc/opt/csw/bind/db.0";?


};
? 


zone "255.in-addr.arpa" {?


type master; 
file "/etc/opt/csw/bind/db.255";?


};? 
?


include "/etc/opt/csw/bind/named.conf.local";?





};

view "external" {?


match-clients { any; !192.168.0.0/22; !127.0.0.1; };?


allow-recursion { 127.0.0.1;?                 }; 


include "/etc/opt/csw/bind/named.conf.external"; 

zone "." { 

type hint;?
file "/etc/opt/csw/bind/db.root";?
};
?


};

Then later I could build another view once my network grows over the internet without taking into consideration VPN's for the moment:

view "trusted_wan" {
match-clients { IP1; IP2; !192.168.0.0/22; !127.0.0.1; };?


allow-recursion { 127.0.0.1;?                 }; 


include "/etc/opt/csw/bind/named.conf.external"; 



zone "." { 

type hint;?
file "/etc/opt/csw/bind/db.root";?
};

};

and slot this view after the "internal" view! What do you think?

Kaya



 

-----Original Message-----
From: Kevin Darcy <kcd at chrysler.com>
To: bind-users at lists.isc.org
Sent: Wed, Jul 1, 2009 2:23 am
Subject: Re: Using DNS servers to query root servers from WAN









The first view matched is the one which is selected.?
?

External clients are matching the "external" view, but they are not 
allowed to recurse. Therefore they can only see the root zone and/or 
whatever authoritative zones you've defined in that "include" file.?
?

Note that the "all" view is *never* matched, since everything will have 
already matched "internal" or "external" before getting that far.?
?

The bigger security question is: why would you want arbitrary external 
clients to be able to query arbitrary names through you? That makes you 
an "open recursor" and ripe for cache poisoning, etc.?
?

If you want to allow a *limited* set of clients on the other side of 
your NAT to query Internet names, then add them to the "internal" view. 
Optionally, change the name of the "internal" view to something which 
more accurately reflects its intent, e.g. "trusted_ranges" or whatever.?
?

?                                                                       
?                                  - Kevin?
?





 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20090630/c557f8ed/attachment.html>