reverse lookup for RFC1918 in view failed
Hans.Mayer at iiasa.ac.at
Sun Jun 6 11:02:19 UTC 2021
I have a strange behaviour which I can’t explain. So I am asking for help.
In my named.conf I have two views. One view is called „intern“ ( German internally ) and the other is called „fueralle“ ( German "for everyone" )
In the internal view I have a response-policy with two zones, a „drop“ zone and a „passthru“ zone where I rewrite some IP addresses for internal use. The "match-clients“ definition is defined with „lokal“ which is the local IPv4 address range 192.168.0.0/16 and the public IPv6 address but no loopback, either IPv6 or IPv4.
The "for everyone“ zone has everything else. It has the domain name as master and some others as slave and also "168.192.IN-ADDR.ARPA“ ; match-clients is defined with „any“
The server is physically located in network 192.168.0.0 and reachable from the world via NAT and has also a public available IPv6 address.
Now the behaviour is the following: When I query from the local IPv6 or IPv4 network with „dig -x“ for an IP address I get back „status: NXDOMAIN“
But when I do the same on the server itself using the loopback addresses for IPv6 or IPv4 it works fine. It also works, if the query comes from the Internet over IPv4 with NAT or with the public IPv6 address. If I query „normal forward“ for an IP with a given name then it works in any case and from every location. This is interesting because the reverse lookup zone and the normal forward zone are both in the same view „fueralle“.
If I remove the views it works as I would expect.
I am using BIND 9.16.16 (Stable Release) <id:0c314d8> running on Linux x86_64 4.19.0-16-amd64
Any help is welcome.
Ing. Dipl.-Ing. Hans Mayer
Network Unix Security Team (NUST)
Information and Communication Technologies (ICT)
International Institute for Applied Systems Analysis (IIASA)
A-2361 Laxenburg, Austria
Phone: +43 2236 807 Ext 215
Mobile: +43 676 83 807 215
E-Mail: hans.mayer at iiasa.at<mailto:hans.mayer at iiasa.at>
Note: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it.
On 01.06.2021, at 17:31, Anand Buddhdev <anandb at ripe.net<mailto:anandb at ripe.net>> wrote:
On 01/06/2021 17:18, Cuttler, Brian R (HEALTH) via bind-users wrote:
From what I'm reading I should be sending a notify from the primary
to the secondary when a dynamic zone is updated but I don't seem to be
Would someone please point me to the option I'm missing to do so?
I've either completely missed it, mis-understood what I read or am going in
the wrong direction.
You need an "also-notify" option for that zone. Read more about this in
the BIND documentation:
While this documentation refers to the latest stable version of BIND, it
should still apply to the older version you're using.
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.
bind-users mailing list
bind-users at lists.isc.org
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the bind-users