Re: stealth with views?

2013-11-07 Thread Kevin Darcy
There's no requirement that the contents of SOA.MNAME have a matching A record in the zone. Even if such a formal requirement existed, you might be able to satisfy it by putting an A record of 0.0.0.0 in the zone. That doesn't expose much :-) If you're paranoid about zone expiration, tune the

Re: stealth with views?

2013-11-07 Thread Jonathan Reed
> > Expire time should be at least a week. If your firewall blocks > connections for that long, you have bigger problems than this. Unless our sites change for disaster recovery, in which expire times might be exceeded. However, I suppose one week would give me enough time to adjust where the mast

Re: stealth with views?

2013-11-07 Thread Barry Margolin
In article , Jonathan Reed wrote: > I'd like my global BIND server to slave a copy of my zone from the master > being hosted on my LAN. It appears that this is called a stealth setup. I > figured I'd achieve this by having the secondary on the internet slave a > view, but I've read that this is

Re: Problem resolving my google country domain from certain servers

2013-11-07 Thread Barry Margolin
In article , Carlos R Laguna wrote: > I am facing some issue with all my dns cache, Bind version 9.7.3 the are > all behind a nat, and all seem to work fine except www.google.com.cu i > try to resolve using nslookup or dig http://paste.desdelinux.net/4883 > but got nothing out of it, any light o

Re: stealth with views?

2013-11-07 Thread Sten Carlsen
This is pretty much what I do. I have one server behind a NAT with two views: internal, resolving, has all internal names - external, not resolving, has the master for my zones. My DNS provider slaves my zones off the master on my LAN, I have not put my master's IP in the zone data, what is in th

RPZ enabled sets TTL to 0 for ANY queries

2013-11-07 Thread Daniel Stirnimann
Hello Sorry, for cross-posting this question. I've posted this question one week ago on http://lists.redbarn.org/mailman/listinfo/dnsfirewalls already but got no answer. So, I try it here as well. I use BIND 9.9.4 on a caching only resolver and have RPZ enabled. If I do a lookup for any query-nam

stealth with views?

2013-11-07 Thread Jonathan Reed
I'd like my global BIND server to slave a copy of my zone from the master being hosted on my LAN. It appears that this is called a stealth setup. I figured I'd achieve this by having the secondary on the internet slave a view, but I've read that this is not ideal from a security standpoint. The arg

Problem resolving my google country domain from certain servers

2013-11-07 Thread Carlos R Laguna
I am facing some issue with all my dns cache, Bind version 9.7.3 the are all behind a nat, and all seem to work fine except www.google.com.cu i try to resolve using nslookup or dig http://paste.desdelinux.net/4883 but got nothing out of it, any light over this will be really appreciated, i can send

Re: Recursive DNS server cannot resolve the reverse zone records from my IPv6 private network

2013-11-07 Thread Niall O'Reilly
On 6 Nov 2013, at 18:30, Listas wrote: > ;; QUESTION SECTION: > ;f.1.4.2.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.5.a.8.3.2.e.3.e.0.0.c.f.ip6.arpa. IN > PTR And placed the following (and more) data at http://adminlinux.com.br/recursive-bind.conf /etc/bind/named.conf.local-ip6: zone "5.a.8.3.2.e.