<div dir="ltr">I am not seeing that but thanks for the heads up. I will keep an eye on it. </div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Sep 8, 2016 at 10:14 AM, Bob Harold <span dir="ltr"><<a href="mailto:rharolde@umich.edu" target="_blank">rharolde@umich.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div><div>I changed the subject slightly, because I had to cut out a lot of the forwarded message - the list server was complaining about the size of the messages.</div></div><div><br></div><div>I just found that my setup was not working completely as I expected. The view with only a few zones and forwarding to another view automatically got the "empty zones" created, so any queries in those zones did not get forwarded. I am fixing it by adding to that view the line:</div><div> empty-zones-enable no;</div><div><br></div><div>-- </div><div>Bob Harold</div><div><br></div>
<br><div class="gmail_quote">On Thu, Sep 8, 2016 at 9:41 AM, Bob Harold <span dir="ltr"><<a href="mailto:rharolde@umich.edu" target="_blank">rharolde@umich.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div><div><br></div></div><div class="gmail_quote"><span>On Thu, Sep 8, 2016 at 9:13 AM, project722 <span dir="ltr"><<a href="mailto:project722@gmail.com" target="_blank">project722@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Bob, in our prod environment, we are allowing 127.0.0.1 to make zone transfers. First off, what is the reasoning or benefit of allowing localhost to make zone transfers? Secondly, In my new view config since I will be using 127.0.0.1 as a forwarder, would this in any way cause a problem or a conflict if I was to leave the localhost IP in the ACL for zone transfers?</div></blockquote><div><br></div></span><div>I would allow 127.0.0.1 to do zone transfers for troubleshooting purposes, if I am on the server and want to look at a whole zone. But it is not required, if you don't use it for transfers.</div><div>Allowing zone transfers should not affect its use for forwarding, as far as I can see.</div><div><div><div><br></div><div>-- </div><div>Bob Harold</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div><div class="gmail_extra"><div class="gmail_quote">On Wed, Sep 7, 2016 at 2:30 PM, Bob Harold <span dir="ltr"><<a href="mailto:rharolde@umich.edu" target="_blank">rharolde@umich.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div><div><div style="color:rgb(0,0,0);font-size:12.8px">You should change:</div><span><span style="font-size:12.8px"> <span style="color:rgb(0,0,0);font-size:12.8px">match-clients { internal; key tsigkey; !key tsigkeyext;</span></span></span><span><div style="color:rgb(0,0,0);font-size:12.8px"><span style="font-size:12.8px">To:</span></div><div style="color:rgb(0,0,0);font-size:12.8px"><span style="font-size:12.8px"> </span><span style="font-size:12.8px">match-clients { </span><span style="font-size:12.8px">!key tsigkeyext; </span><span style="font-size:12.8px">internal; key tsigkey;</span></div><div style="color:rgb(0,0,0);font-size:12.8px"><span style="font-size:12.8px"><br></span></div><div style="color:rgb(0,0,0);font-size:12.8px">The 'not' (!) won't work if it is last, they are checked in order, so it needs to be first.</div><div><br></div></span><span><font color="#888888"><div>-- </div><div>Bob Harold</div></font></span></div></div><div><div>
<div class="gmail_extra"><br></div><br><div class="gmail_quote">On Wed, Sep 7, 2016 at 3:21 PM, project722 <span dir="ltr"><<a href="mailto:project722@gmail.com" target="_blank">project722@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">I think I have found the problem. I did not need dnssec enabled after all. All this time I thought it was needed for TSIG to work. But apparently, the forwarding is working, and zone transfers are going to the right view without it enabled. </div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Sep 7, 2016 at 1:15 PM, project722 <span dir="ltr"><<a href="mailto:project722@gmail.com" target="_blank">project722@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Ok I'm with you now. I have reconfigured my servers and I cant get the forwarding to work. Since 127.0.0.1 is forwarding request, I made sure in the options stanza to set it to a listen IP. I have tried several different variations of this method and all end up with SERVFAIL's using dig from a client that gets the "internal" view. Here is my config. <div><br></div><div><div>acl internal {</div><div><a href="http://192.168.254.0/23" target="_blank">192.168.254.0/23</a>; // corpnet</div><div>};</div><div><br></div><div>acl external {</div><div><a href="http://192.168.155.0/24" target="_blank">192.168.155.0/24</a>;</div><div><a href="http://192.168.160.0/24" target="_blank">192.168.160.0/24</a>;</div><div>}; </div></div><div><br></div><div><div>options {</div><div> listen-on port 53 { 192.168.155.128; 127.0.0.1; }; #Master DNS Servers IP</div><div> directory "/var/named";</div><div> dump-file "/var/named/data/cache_dump.db<wbr>";</div><div> statistics-file "/var/named/data/named.stats";</div><div> memstatistics-file "/var/named/data/named_mem_sta<wbr>ts.txt";</div></div><div> allow-query { internal; external; }; <br></div><div> dnssec-enable yes;</div><div> dnssec-validation auto;</div><div> dnssec-lookaside auto;</div><div> zone-statistics yes;</div><div><br></div><div> /* Path to ISC DLV key */</div><div> bindkeys-file "/etc/named.iscdlv.key";</div><div><br></div><div> managed-keys-directory "/var/named/dynamic";</div><div><br></div><div>};</div><div><br></div><div><div>key "tsigkey" {</div><div> algorithm HMAC-SHA512;</div><div>secret "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx<wbr>";</div><div>};</div><div><br></div><div>key "tsigkeyext" {</div><div>algorithm HMAC-SHA512;</div><div>secret "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx<wbr>x";</div><div>};</div></div><div><br></div><div>// Start internal view</div><div><br></div><div><div>view "corpnet" {</div><div> match-clients { internal; key tsigkey; !key tsigkeyext;</div><div>};</div><div> </div><div> //IP of slave server</div><div> server 192.168.155.77 {</div><div> keys { tsigkey; };</div><div>};</div><div><br></div><div> also-notify {</div><div> 192.168.155.77; </div><div>};</div><div><br></div><div> zone "<a href="http://example.com" target="_blank">example.com</a>" IN { //this zone has one zone file per view</div><div> type master;</div><div> file "/var/named/<a href="http://db.examplein.com" target="_blank">db.examplein.com</a>";</div><div> allow-query { internal; };</div><div> allow-transfer { key tsigkey; };</div><span><div>};</div><div><br></div><div> forwarders {</div><div> // forward to external view</div><div> 127.0.0.1;</div><div>};</div><div><br></div><div> forward only;</div><div><br></div></span><div> include "/etc/named.rfc1912.zones";</div><div> include "/etc/named.root.key";</div><div>};</div></div><div><br></div><div>// Start external view</div><div><br></div><div><div>view "external" {</div><div> match-clients { any; 127.0.0.1; };</div><div><br></div><div> //IP of slave server</div><div> server 192.168.155.77 {</div><div> keys { tsigkeyext; };</div><div>};</div><div> </div><div> also-notify {</div><div> 192.168.155.77; </div><div>};</div><div><br></div><div> zone "." IN {</div><div> type hint;</div><div> file "<a href="http://named.ca" target="_blank">named.ca</a>";</div><div>};</div><div><br></div><div> zone"<a href="http://testdns.net" target="_blank">testdns.net</a>" IN {</div><div> type master;</div><div> file "db.testdns.net-ext";</div><div> allow-query { any; 127.0.0.1; };</div><div> allow-transfer { key tsigkeyext; ext_ns; };</div></div><div>};</div><div><br></div><div><div> zone"<a href="http://example.com" target="_blank">example.com</a>" IN { //this zone has one zone file per view</div><div> type master;</div><div> file "/var/named/<a href="http://db.exampleout.com" target="_blank">db.exampleout.com</a>"<wbr>;</div><div> allow-query { any; 127.0.0.1; };</div><div> allow-transfer { key tsigkeyext; ext_ns; };</div><div>};</div><div> include "/etc/named.rfc1912.zones";</div><div> include "/etc/named.root.key";</div><div>};</div><div><br></div><div><br></div></div></div></blockquote></div></div></div></div></blockquote></div></div></div></div></div></blockquote></div></div></div></div></blockquote></div></div></div></div></div></blockquote></div></div></div>
</blockquote></div><br></div>