Chris,<br><br>Thanks that worked.....<br><br>RootNet08<br><br><div class="gmail_quote">On Tue, Nov 18, 2008 at 12:46 AM, Chris Buxton <span dir="ltr"><<a href="mailto:cbuxton@menandmice.com">cbuxton@menandmice.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div style=""><div><span style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Verdana; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;"><div>
Remove your subnet from the bogons ACL at the beginning.</div><div><br></div><div>acl bogons {</div><div><span style="white-space: pre;"> </span>! <a href="http://192.168.16.0/21" target="_blank">192.168.16.0/21</a>;<br></div>
<div class="Ih2E3d"><div><span style="white-space: pre;"> </span><a href="http://0.0.0.0/8" target="_blank">0.0.0.0/8</a>;<br></div></div><div><span style="white-space: pre;"> </span>[...]<br></div><div><span style="white-space: pre;"> </span><a href="http://192.168.0.0/16" target="_blank">192.168.0.0/16</a>;<br>
</div><div><span style="white-space: pre;"> </span>[...]<br></div><div>};</div><div><br>Chris Buxton</div><div>Professional Services</div><div>Men & Mice</div></span> </div><br><div><div><div></div><div class="Wj3C7c">
<div>On Nov 17, 2008, at 8:38 PM, root net wrote:</div><br></div></div><blockquote type="cite"><div><div></div><div class="Wj3C7c">Hello,<br><br>I have a server I am testing before I put in production. Working on a more secure bind config. BTW if anyone has any other suggestions on locking down bind beside below and chroot let me know. I was adding views which has been debated time and time again whether or not it really helps but anyway. My problem is I have the latest bogons from team-cymru which includes my internal network subnet <a href="http://192.168.16.0/21" target="_blank">192.168.16.0/21</a>. So in the bogons list it says <a href="http://192.168.0.0/16" target="_blank">192.168.0.0/16</a> which is blackholed. So my local network is being blackholed but it works fine when users not on the bogons query the server from the external view. My question is how can I get this to work without adding each cidr block of the <a href="http://192.168.0.0/16" target="_blank">192.168.0.0/16</a> separately or even breaking it up in /21s? I have tried everything I know how. A sanitized portion of my named.conf is this:<br>
<br>//For length sakes I took out the other networks.....<br><br>acl i_lan { <a href="http://127.0.0.1" target="_blank">127.0.0.1</a>; <a href="http://192.168.16.0/21" target="_blank">192.168.16.0/21</a>};<br>acl i_dns { <a href="http://127.0.0.1" target="_blank">127.0.0.1</a>; <a href="http://192.168.16.2" target="_blank">192.168.16.2</a>; <a href="http://192.168.23.2" target="_blank">192.168.23.2</a>;};<br>
acl bogons { <a href="http://0.0.0.0/8" target="_blank">0.0.0.0/8</a>;<br> <a href="http://1.0.0.0/8" target="_blank">1.0.0.0/8</a>;<br> <a href="http://2.0.0.0/8" target="_blank">2.0.0.0/8</a>;<br> <a href="http://5.0.0.0/8" target="_blank">5.0.0.0/8</a>;<br>
<a href="http://192.168.0.0/16" target="_blank">192.168.0.0/16</a>;<br> <a href="http://198.18.0.0/15" target="_blank">198.18.0.0/15</a>;<br> <a href="http://223.0.0.0/8" target="_blank">223.0.0.0/8</a>;<br> <a href="http://224.0.0.0/3" target="_blank">224.0.0.0/3</a>;<br>
};<br><br>options {<br> version "Go Away";<br> directory "/var/named";<br> dump-file "/var/dump/named_dump.db";<br> pid-file "/var/run/named/named.pid";<br>
statistics-file "/var/stats/named.stats";<br> recursion no;<br> allow-query { any; };<br> listen-on { <a href="http://127.0.0.1" target="_blank">127.0.0.1</a>; <a href="http://192.168.16.2" target="_blank">192.168.16.2</a>;};<br>
recursive-clients 1000;<br> tcp-clients 1000;<br> auth-nxdomain yes;<br> blackhole { bogons; };<br><br>view "internal" {<br> match-clients { i_lan; };<br> notify no;<br>
recursion yes;<br> allow-transfer { i_dns;};<br>zone "localhost" {<br> type master;<br> file "localhost.zone";<br>};<br>zone "127.in-addr.arpa" {<br> type master;<br>
file "localhost.zone";<br>};<br>zone "0.in-addr.arpa" {<br> type master;<br> file "named.zero";<br>};<br>zone "255.in-addr.arpa" {<br> type master;<br> file "named.broadcast";<br>
<br>// zones go here<br>};<br><br>view "external" {<br> match-clients { !i_lan; any; } ;<br> recursion no;<br> allow-transfer { i_dns;};<br>// zones go here<br>};<br><br><br>Any help is appreciated and thanks in advanced.<br>
<br>RootNet08<br></div></div> _______________________________________________<br>bind-users mailing list<br><a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br><a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a></blockquote>
</div><br></div></blockquote></div><br>