<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFCC">
This is pretty much what I do.<br>
<br>
I have one server behind a NAT with two views: internal, resolving,
has all internal names - external, not resolving, has the master for
my zones.<br>
<br>
My DNS provider slaves my zones off the master on my LAN, I have not
put my master's IP in the zone data, what is in the file is not
important. Slaves transfer the zone data, not the file. I just
checked and can not find any trace of my IP in the output from the
public servers.<br>
<br>
I can check in my log when the slaves transfer the data, I have not
had any case where data ran out, set TTLs high enough.<br>
<br>
I see a major panic when my ISP gives me a new IP (happens rarely,
but has happened), then I need to tell the slaves that a new master
is in place, can be done, but must be done right for this provider.<br>
<br>
<br>
<div class="moz-cite-prefix">On 07/11/13 19.52, Jonathan Reed wrote:<br>
</div>
<blockquote
cite="mid:CAPw9y047jFNwDveuZ-h38=Fk7juMw41q4Sje7p-8tBetgpp6bA@mail.gmail.com"
type="cite">
<div dir="ltr">I'd like my global BIND server to slave a copy of
my zone from the master being hosted on my LAN. It appears that
this is called a stealth setup. I figured I'd achieve this by
having the secondary on the internet slave a view, but I've read
that this is not ideal from a security standpoint. The argument
being that the zone file contains an IP address of it's master.
So whats the best way to do this?
<div>
<div><br>
</div>
<div>A stealth scenario also seems susceptible to a higher
chance where the connection is lost between master and slave
(complicated by a LAN firewall/ISP in between) and the
expire exceeding. We're hosting our global DNS through a
provider, so there doesnt seem like an easy way to monitor
and confirm a zone transfer from our master alone. Any
recommendations?</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Please visit <a class="moz-txt-link-freetext" href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list
bind-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>
<a class="moz-txt-link-freetext" href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a></pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Best regards
Sten Carlsen
No improvements come from shouting:
"MALE BOVINE MANURE!!!"
</pre>
</body>
</html>