Puzzling scenario involving views

Peter Rabbitson rabbit at rabbit.us
Tue Aug 17 01:35:39 UTC 2004


Hello list, 
I have a bind9 serving the domain example.com, with a secondary backup dns
(secondary.com) at a remote location. I wanted to achieve redundancy of 
both domains provided to each other (example.com has secondary.com as
2nd NS, and vice versa), and at the same time I wanted to define internal
and external views in example.com for internal network naming purposes. I
got it working fairly quick with the example below, however here is my 
problem: members of the insiders acl would not receive an AA answer when 
inquiring about secondary.com. I was thinking that views are not terminating
and "insiders" would see both the internal and external view at the same
time. If however this is not the case - how do I place secondary.com in 
both views without breaking AXFRs? Can I specify a slave zone reference to 
the same zone file and then explicitly allow-notify { none; }; in the 
internal slave zone statement? Or is there another approach that I can not
think of?

acl "insiders" {
    192.168.0.0/24;
    127.0.0.1;
    };
    
acl "secondary" {
    xxx.xxx.xxx.xxx;
    };

view "internal" {
    match-clients { insiders; };

    zone "." {
    type hint;
    file "db.root";
    };

    zone "example.com" {
    type master;
    file "example-int.com";
    allow-query { insiders; };
    };
    
    zone "0.168.192.in-addr.arpa" {
    type master;
    file "example-int.rev";
    allow-query { insiders; };
    };
};

view "external" {
    match-clients { any; };

    zone "." {
    type hint;
    file "db.root";
    };

    zone "example.com" {
    type master;
    file "example-ext.com";
    allow-transfer { secondary; };
    };

    zone "secondary.com" {
    type slave;
    file "slave.secondary.com";
    masters { xxx.xxx.xxx.xxx; };
    };

    zone "com" { type delegation-only; };
    zone "net" { type delegation-only; };

};


Thanks

Peter




More information about the bind-users mailing list