<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<pre>The syntax for a forward zone is:
zone <var><a href="http://www.bind9.net/doc-v8/docdef.html">domain_name</a></var> [ ( in | hs | hesiod | chaos ) ] {
type forward;
[ forward ( only | first ); ]
[ forwarders { [ <var><a
href="http://www.bind9.net/doc-v8/docdef.html">ip_addr</a></var> ; [ <var>ip_addr</var> ; ... ] ] }; ]
[ check-names ( warn | fail | ignore ); ]
};
</pre>
For the kind of access control you're trying to achieve, use a "view".
The syntax is as follows.<br>
view view_name<br>
[class] {<br>
match-clients { address_match_list };<br>
match-destinations { address_match_list };<br>
match-recursive-only yes_or_no ;<br>
[ view_option; ...]<br>
[ zone_statement; ...]<br>
};<br>
<br>
Do some perusing of the Administrator's Reference Manual (ARM). You
might find the information in there quite useful.<br>
<br>
Regards,<br>
Richard<br>
<br>
Prabhat Rana wrote:
<blockquote cite="mid:246752.37753.qm@web57510.mail.re1.yahoo.com"
type="cite">
<pre wrap="">Hi Nuno,
Thanks for the response. However, I don't own the authoritative servers. And the clients that I am serving don't have direct access to the authoritative servers.
Prabhat.
--- On Mon, 7/12/10, Nuno Paquete <a class="moz-txt-link-rfc2396E" href="mailto:nunopaquete@lusocargo.pt"><nunopaquete@lusocargo.pt></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">From: Nuno Paquete <a class="moz-txt-link-rfc2396E" href="mailto:nunopaquete@lusocargo.pt"><nunopaquete@lusocargo.pt></a>
Subject: Re: ACL for forward zone
To: "Prabhat Rana" <a class="moz-txt-link-rfc2396E" href="mailto:prana9533@yahoo.com"><prana9533@yahoo.com></a>
Cc: <a class="moz-txt-link-abbreviated" href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>
Date: Monday, July 12, 2010, 4:17 PM
Hi Prabhat,
I think you don't need this ACL in your forwarder server,
define it on
the authoritative server (1.2.3.4 and 5.6.7.8, according to
your
example).
Regards,
Nuno Paquete
No dia 2010/07/12, às 19:27, "Prabhat Rana" <a class="moz-txt-link-rfc2396E" href="mailto:prana9533@yahoo.com"><prana9533@yahoo.com></a>
escreveu:
</pre>
<blockquote type="cite">
<pre wrap="">Hello all,
I have BIND 9.7.1 installed in Solaris 10. I need to
</pre>
</blockquote>
<pre wrap="">use a forwarder
</pre>
<blockquote type="cite">
<pre wrap="">for a certain internal private IP zone to a certain
</pre>
</blockquote>
<pre wrap="">internal DNS
</pre>
<blockquote type="cite">
<pre wrap="">severs. In the meantime I need to use certain ACL so
</pre>
</blockquote>
<pre wrap="">that it would
</pre>
<blockquote type="cite">
<pre wrap="">forward the queries and reply to them only from
</pre>
</blockquote>
<pre wrap="">certain IP address
</pre>
<blockquote type="cite">
<pre wrap="">clients. So I used the following conifgs in
</pre>
</blockquote>
<pre wrap="">named.conf
</pre>
<blockquote type="cite">
<pre wrap="">acl "Internal" {10.0.1.0/24)
zone "10.in-addr.arpa" in {
type forward;
forwarders { 1.2.3.4;
</pre>
</blockquote>
<pre wrap="">5.6.7.8; };
</pre>
<blockquote type="cite">
<pre wrap=""> allow-query { "Internal";
</pre>
</blockquote>
<pre wrap="">};
</pre>
<blockquote type="cite">
<pre wrap="">However it appears I can't use 'allow query'
</pre>
</blockquote>
<pre wrap="">option in forward zone
</pre>
<blockquote type="cite">
<pre wrap="">as seen in the syslog
/etc/named.conf:102: option 'allow-query' is not
</pre>
</blockquote>
<pre wrap="">allowed in
</pre>
<blockquote type="cite">
<pre wrap="">'forward' zone '10.in-addr.arpa'
Basically you know what I'm trying to achieve. So if
</pre>
</blockquote>
<pre wrap="">anyone has any
</pre>
<blockquote type="cite">
<pre wrap="">tip how can I use forward from the clients only within
</pre>
</blockquote>
<pre wrap="">certain IP
</pre>
<blockquote type="cite">
<pre wrap="">address range, that would be great.
Prabhat.
_______________________________________________
bind-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>
<a class="moz-txt-link-freetext" href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a>
</pre>
</blockquote>
</blockquote>
<pre wrap=""><!---->
</pre>
<pre wrap=""><!---->
_______________________________________________
bind-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>
<a class="moz-txt-link-freetext" href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a>
</pre>
</blockquote>
</body>
</html>