Re: Overwrite A record from DNSSEC protected domain if I am the owner of the domain

2017-04-26 Thread Mathew Ian Eis
What you are describing more generally sounds like what is known as split-view or split-horizon DNS. In short, you split all (or part by virtue of delegation or forwarders) of your namespace into “internal” and “external” partitions; this is documented in the context of BIND here: https://ftp.i

Re: allow-transfer with distinct IP rejected

2017-04-26 Thread Dr. Lars Hanke
Thanks for your help. I had some trouble with the log file and after I got it going I identified the point of failure quickly. The firewall was misconfigured and applied NAT on internal traffic. However, someone mentioned that idea. Otherwise I'd probably had banged my head for hours seeing the

Re: Overwrite A record from DNSSEC protected domain if I am the owner of the domain

2017-04-26 Thread Matus UHLAR - fantomas
On 26.04.17 18:36, Matthias Fechner wrote: I have a domain fechner.net which is protected using DNSSEC. The zone is managed on a server located in a data center. Some A records are pointing to a computer that has a low speed internet connection on the WAN site, but very fast connection on the

Overwrite A record from DNSSEC protected domain if I am the owner of the domain

2017-04-26 Thread Matthias Fechner
Dear all, I have a domain fechner.net which is protected using DNSSEC. The zone is managed on a server located in a data center. Some A records are pointing to a computer that has a low speed internet connection on the WAN site, but very fast connection on the LAN site. If I know located in

Re: allow-transfer with distinct IP rejected

2017-04-26 Thread Steven Carr
On 26 April 2017 at 08:23, Nico CARTRON wrote: > BIND logs refers to the IP address 172.16.10.16, can you tell us what is this > IP? > It appears that this is this IP address which is trying to transfer the zone, > and as you are restricting zone transfers to the slave IP address > (172.16.11.35),

Re: allow-transfer with distinct IP rejected

2017-04-26 Thread Nico CARTRON
Hi Lars, On 26-Apr-2017 09:10 CEST, wrote: > Am 26.04.2017 um 08:22 schrieb Steven Carr: > > On 26 April 2017 at 06:53, Dr. Lars Hanke wrote: > > > allow-transfer { 172.16.11.35; }; > > This IP ^^^ > > > > > transfer of '178.168.192.in-addr.arpa/IN' from 172.16.10.16#53: failed > > > while >

Re: allow-transfer with distinct IP rejected

2017-04-26 Thread Dr. Lars Hanke
Am 26.04.2017 um 08:22 schrieb Steven Carr: On 26 April 2017 at 06:53, Dr. Lars Hanke wrote: allow-transfer { 172.16.11.35; }; This IP ^^^ transfer of '178.168.192.in-addr.arpa/IN' from 172.16.10.16#53: failed while receiving responses: REFUSED Is not the same as the IP the AXFR request is