Hmm, I'll admit to only skim reading it but is seems quite complicated
for what I was hoping for. It would be trivial if I could change the
bind-internal machine to using dnsmasq (ugh!). Then the bind-internal
machine would serve up anything it explicitly knew about to the internal
clients, and anything that it didn't know about, it would automatically
request from the internet, which would include the bind-external
machine. Then, if I configured external IP's on bind-external only, they
would still be returned by by bind-internal to the machines using
bind-internal as their resolver. I was hoping I could set something like
recursion=true in bind-internal and recursion=false on bind-external,
only in my configs for BIND 9.9.6-P1, it is not set at all so I am not
sure how it is configured as authoritative.
Nick
On 2023-11-03 16:01, Andrew Latham wrote:
* That sounds like a sadly normal implementation but yes you can do
better* Views is a good place to look https://kb.isc.org/docs/aa-00851
* Make sure to investigate how the company VPN services handle DNS as
it may surprise you
On Fri, Nov 3, 2023 at 9:52 AM Nick Howitt via bind-users
<bind-users@lists.isc.org> wrote:
Hi,
I am fairly new to bind but I am thinking my company's use of it is
sub-optimal. We have two bind masters (and a few slaves), one for
internal use so all our internal servers point to it or its slaves
as
their DNS resolvers. I will call the internal one bind-internal and
the
external one bind-external.
Bind-internal is set up as authoritative for the domain example.com
[1].
Bind-external is also set up as authoritative for example.com [1].
Bind-internal has all sorts of entries resolving in the 10.30, 10.40
and
other private ranges, but it also has entries resolving to our
public
IP's e.g. demo.example.com [2] resolves to 1.2.3.4 (terminated by an
F5),
which is one of our public ips (munged). As this site is externally
accessible as well, we also have to put an identical entry in
bind-external so we end up having many identical entries in
bind-internal and bind-external. We also have some other domains
covered
by bind-internal with external IPs, but externally they are covered
by
the domain host's DNS and they have the same issue where in
bind-internal we have some public IP's which are also in the domain
host's DNS for external access.
I have a feeling this is a sub-optimal setup, having to maintain
external IPs in both bind-internal and bind-external. Does it make
sense
to stop bind-internal from being authoritative and make it a
resolver/caching name server? This way, if it does not find an entry
in
bind-internal it will then go out to either bind-external or the
domain
host's DNS to get the answer from the authoritative servers and then
there is no need to maintain external IPs in bind internal.
TIA,
Nick
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to
unsubscribe from this list
ISC funds the development of this software with paid support
subscriptions. Contact us at https://www.isc.org/contact/ for more
information.
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
--
- Andrew "lathama" Latham -
Links:
------
[1] http://example.com
[2] http://demo.example.com
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from
this list
ISC funds the development of this software with paid support subscriptions.
Contact us at https://www.isc.org/contact/ for more information.
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
