<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Palatino Linotype";
panose-1:2 4 5 2 5 5 5 3 3 4;}
@font-face
{font-family:Webdings;
panose-1:5 3 1 2 1 5 9 6 7 3;}
@font-face
{font-family:Centaur;
panose-1:2 3 5 4 5 2 5 2 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="FR-CH" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">hi<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">you could do a small script, running e.g. on you public dns server, that make a zone xfer of the zone on storage,
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">and replace the NS / SOA of your storage box by the public DNS NSs.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">philippe<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:FR-CH">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:FR-CH"> bind-users-bounces+philippe.simonet=swisscom.com@lists.isc.org
[mailto:bind-users-bounces+philippe.simonet=swisscom.com@lists.isc.org] <b>On Behalf Of
</b>Garsiot, Thomas<br>
<b>Sent:</b> Friday, January 18, 2013 4:34 PM<br>
<b>To:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> transparently forwarding a zone<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-CA">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">I have an issue with domain forwarding.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">I'm managing public DNS servers for, say, mydomain.com.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">We're currently setting a storage system which relies on DNS for load balancing. The system is made of 4 nodes with IP addresses 10.0.0.1, 2, 3, 4.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">The vendor recommands a stub zone to be created with forwarders set to the 4 IP addresses (i.e their storage system acts as a mini-DNS server).
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">However, we need this resolution to occur over the internet, so obviously the stub zone solution does not work because DNS resolvers on the internet would retrieve the NS list for the subdomain and try to query it directly.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">We need to be able to resolve on the internet anything of the format :
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">xxxx.storage.mydomain.com or yyyy.xxxx.storage.mydomain.com<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">so what I need is my public DNS servers to be owners of the storage.mydomain.com but still rely on the storage system for more specific host resolution.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">Some kind of a stealth DNS server but with a forward rather than a master-slave scheme.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">We've tried several solutions but none was fully successful.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">SOLUTION 1:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">============<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">in mydomain.com zone file : <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">storage IN NS ns-storage.mydomain.com.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">ns-storage IN A 2.2.2.2 <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">where 2.2.2.2 is a public VIP on the internet that load balances DNS traffic to 10.0.0.1 -> 4<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">SOLUTION 1 results : <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">====================<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">partially works :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">when querying google's resolving DNS server for test, both xxxx.storage.mydomain.com or yyyy.xxxx.storage.mydomain.com resolve fine to the 4 private IP addresses.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">however, in certain environments, xxxx.storage.mydomain.com works but not yyyy.xxxx.storage.mydomain.com.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">My guess is that google for some reason sent a recursive query for yyyy.xxxx.storage.mydomain.com to the NS of storage.mydomain.com while the other environment was sending an iterative query and thus tried to query the
internal addresses of the storage box.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">In the situation that fails what I think is happening is :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">Resolver -> mydomain.com NS servers : query NS storage.mydomain.com<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">mydomain.com NS servers -> resolver : storage.mydomain.com's NS is ns-storage which translates to 2.2.2.2<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">Resolver -> 2.2.2.2 : query NS for xxxx.storage.mydomain.com
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">2.2.2.2 -> resolver : returns 4 NS records corresponding to 10.0.0.1 ->4<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">Resolver -> 10.0.0.1,2,3 or 4 : fails because private IP is not reachable.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">SOLUTION 2: <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">============<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">in named.conf :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">zone "storage.mydomain.com" {<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">type forward;<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">forwarders { 2.2.2.2; };<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">//forward only;<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">};<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">I've tried with and without the "forward only directive" - no change.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">Tried it with the internal IP addresses 10.x.x.x and external VIP 2.2.2.2.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">SOLUTION 2 results : <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">====================<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">fails<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">a dig for xxxx.storage.mydomain.com gives no answer. Only the authority section pointing to ns1.mydomain.com & ns2.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">SOLUTION 3 :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">============<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">in named.conf :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">zone "storage.mydomain.com" {<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">type forward;<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">forwarders { 2.2.2.2; };<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">//forward only;<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">};<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">in zone file for mydomain.com <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">storage IN NS ns1.mydomain.com <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">storage IN NS ns2.mydomain.com<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">SOLUTION 3 results :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">====================<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">Direct recursive query to mydomain.com name servers works fine<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">Requests through another resolver do not work.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">dig xxx.storage.mydomain.com +trace gives :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">mydomain.com. 172800 IN NS ns1.mydomain.com.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">mydomain.com. 172800 IN NS ns2.mydomain.com.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">;; Received 117 bytes from 192.42.93.30#53(192.42.93.30) in 102 ms<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">storage.mydomain.com. 300 IN NS ns1.mydomain.com<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">storage.mydomain.com. 300 IN NS ns2.mydomain.com<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">mydomain.com. 300 IN SOA ns1.mydomain.com. xxxxxxxx<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">2013011801 3600 900 604800 10800<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">I sometimes get loops with the following messages :
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">storage.mydomain.com. 300 IN NS ns1.mydomain.com<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">storage.mydomain.com. 300 IN NS ns2.mydomain.com<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">;; BAD (HORIZONTAL) REFERRAL<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">;; Received 117 bytes from xx in 6 ms <o:p>
</o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"> Any advice on how to get this done ?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"> Thanks in advance !<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"> Thomas<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:12.0pt;font-family:"Times New Roman","serif";color:navy;mso-fareast-language:EN-CA">___________________________________________<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:navy;mso-fareast-language:EN-CA">Thomas Garsiot<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR-CA" style="font-size:9.0pt;font-family:"Arial","sans-serif";color:navy;mso-fareast-language:EN-CA">Architecture Réseau/Network Architecture, GISSC, CGI Inc.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR-CA" style="font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-language:EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="FR-CA" style="font-size:10.0pt;font-family:Wingdings;color:navy;mso-fareast-language:EN-CA">(</span><span lang="FR-CA" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:navy;mso-fareast-language:EN-CA">
</span><span lang="FR-CA" style="font-size:9.0pt;font-family:"Arial","sans-serif";color:navy;mso-fareast-language:EN-CA">(514) 415-3000 #1015293 (SVP ne pas laisser de messages vocaux/ please do not use voice mail)</span><span lang="FR-CA" style="font-size:9.0pt;font-family:"Centaur","serif";color:navy;mso-fareast-language:EN-CA"><br>
</span><b><span lang="EN-CA" style="font-size:10.0pt;font-family:Webdings;color:navy;mso-fareast-language:EN-CA">Ê</span></b><span lang="EN-CA" style="font-size:10.0pt;font-family:"Arial","sans-serif";color:navy;mso-fareast-language:EN-CA">
</span><span lang="FR-CA" style="font-size:9.0pt;font-family:"Arial","sans-serif";color:navy;mso-fareast-language:EN-CA">(514) 415-3965</span><span lang="FR-CA" style="font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-language:EN-CA"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR-CA" style="font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-language:EN-CA"> <o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="FR" style="font-size:10.0pt;font-family:Webdings;color:green;mso-fareast-language:EN-CA;layout-grid-mode:line">P</span></b><b><span lang="FR" style="font-size:17.0pt;font-family:Webdings;color:green;mso-fareast-language:EN-CA;layout-grid-mode:line">
</span></b><span lang="FR" style="font-size:8.0pt;font-family:"Palatino Linotype","serif";color:green;mso-fareast-language:EN-CA">Avant d'imprimer, pensez à l'environnement</span><span lang="FR" style="font-size:7.0pt;font-family:"Palatino Linotype","serif";color:green;mso-fareast-language:EN-CA">...</span><span lang="FR" style="font-size:9.0pt;font-family:"Palatino Linotype","serif";color:navy;mso-fareast-language:EN-CA"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR-CA" style="font-size:12.0pt;font-family:"Times New Roman","serif";color:navy;mso-fareast-language:EN-CA"><br>
</span><span lang="FR-CA" style="font-size:10.0pt;font-family:"Times New Roman","serif";color:#8080C0;mso-fareast-language:EN-CA">Avis de confidentialité : ce message peut contenir des renseignements confidentiels appartenant exclusivement au Groupe CGI Inc.
ou à ses filiales. Si vous n’êtes pas le destinataire indiqué ou prévu dans ce message (ou responsable de livrer ce message à la personne indiquée ou prévue) ou si vous pensez que ce message vous a été adressé par erreur, vous ne pouvez pas utiliser ou reproduire
ce message, ni le livrer à quelqu’un d’autre. Dans ce cas, vous devez le détruire et vous êtes prié d’avertir l’expéditeur en répondant au courriel.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR-CA" style="font-size:12.0pt;font-family:"Times New Roman","serif";color:navy;mso-fareast-language:EN-CA"> ___________________________________________<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-CA" style="font-size:12.0pt;font-family:"Times New Roman","serif";color:navy;mso-fareast-language:EN-CA"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
</div>
</div>
</body>
</html>