<div dir="ltr"><div><div><div>I understand the concept, but I'm not sure I fully understand how to configure it.<br>I've updated my bind to 9.11 P05 compiled with "--with-ecdsa", and as far as I can read EDNS is enabled for authoritative bind installations automatically.<br></div>But I'm still getting wrong answers from my installation.<br></div>Here are my configurations:<br><br></div>named.conf:<br>options {<br> listen-on port 53 { any; };<br> listen-on-v6 port 53 { any; };<br> directory "/var/named";<br> dump-file "/var/named/data/cache_dump.db";<br> statistics-file "/var/named/data/named_stats.txt";<br> memstatistics-file "/var/named/data/named_mem_stats.txt";<br> allow-recursion { internal; };<br> allow-query { any; };<br> allow-query-cache { none; };<br>};<br>acl internal {<br> service_server_subnet/24;<br> service_server_wan_ip;<br>};<br>view "internal" {<br> match-clients { internal; };<br> zone "<a href="http://example.net">example.net</a>" IN {<br> type master;<br> file "/etc/named/example.net.internal";<br> };<br>};<br>view "external" {<br> match-clients { any; };<br> zone "<a href="http://example.net">example.net</a>" IN {<br> type master;<br> file "/etc/named/example.net.external";<br> };<br>};<br><br><br><br><div>example.net.external:<br>$TTL 3600<br><a href="http://example.net">example.net</a>. IN SOA <a href="http://ns1.example.net">ns1.example.net</a>. <a href="http://example.net">example.net</a>. (<br> 2001062501<br> 21600<br> 3600<br> 604800<br> 3600 )<br><a href="http://example.net">example.net</a>. IN NS <a href="http://ns1.example.net">ns1.example.net</a>.<br><a href="http://example.net">example.net</a>. IN NS <a href="http://ns2.example.net">ns2.example.net</a>.<br><a href="http://example.net">example.net</a>. IN MX 10 <a href="http://mx.zoho.com">mx.zoho.com</a>.<br><a href="http://example.net">example.net</a>. IN MX 20 <a href="http://mx2.zoho.com">mx2.zoho.com</a>.<br><a href="http://ns1.example.net">ns1.example.net</a>. IN A bind_wan_ip<br><a href="http://ns2.example.net">ns2.example.net</a>. IN A bind_wan_ip<br><a href="http://example.net">example.net</a>. IN A service_server_wan_ip<br><a href="http://www.example.net">www.example.net</a>. IN CNAME <a href="http://example.net">example.net</a>.<br><a href="http://mail.example.net">mail.example.net</a>. IN A service_server_wan_ip<br><a href="http://mail.example.net">mail.example.net</a>. IN MX 10 <a href="http://mail.example.net">mail.example.net</a>.<br><a href="http://mail.example.net">mail.example.net</a>. IN SPF "v=spf1 +a +mx +include:<a href="http://mail.example.net">mail.example.net</a> -all"<br><a href="http://service.example.net">service.example.net</a>. IN A service_server_wan_ip<br><br><br><br>example.net.internal:<br>$TTL 3600<br><a href="http://example.net">example.net</a>. IN SOA <a href="http://ns1.example.net">ns1.example.net</a>. <a href="http://example.net">example.net</a>. (<br> 2001062501<br> 21600<br> 3600<br> 604800<br> 3600 )<br><a href="http://example.net">example.net</a>. IN NS <a href="http://ns1.example.net">ns1.example.net</a>.<br><a href="http://example.net">example.net</a>. IN NS <a href="http://ns2.example.net">ns2.example.net</a>.<br><a href="http://example.net">example.net</a>. IN MX 10 <a href="http://mx.zoho.com">mx.zoho.com</a>.<br><a href="http://example.net">example.net</a>. IN MX 20 <a href="http://mx2.zoho.com">mx2.zoho.com</a>.<br><a href="http://ns1.example.net">ns1.example.net</a>. IN A bind_wan_ip<br><a href="http://ns2.example.net">ns2.example.net</a>. IN A bind_wan_ip<br><a href="http://example.net">example.net</a>. IN A service_server_lan_ip<br><a href="http://www.example.net">www.example.net</a>. IN CNAME <a href="http://example.net">example.net</a>.<br><a href="http://mail.example.net">mail.example.net</a>. IN A service_server_lan_ip<br><a href="http://mail.example.net">mail.example.net</a>. IN MX 10 <a href="http://mail.example.net">mail.example.net</a>.<br><a href="http://mail.example.net">mail.example.net</a>. IN SPF "v=spf1 +a +mx +include:<a href="http://mail.example.net">mail.example.net</a> -all"<br><a href="http://service.example.net">service.example.net</a>. IN A service_server_wan_ip<br><br><br><br></div><div>When I dig my subdomain however I get this replies:<br># dig +noall +answer <a href="http://service.example.net">service.example.net</a> @<a href="http://ns1.example.net">ns1.example.net</a><br><a href="http://service.example.net">service.example.net</a>. 3600 IN A service_server_lan_ip<br># dig +noall +answer <a href="http://service.example.net">service.example.net</a> @<a href="http://8.8.8.8">8.8.8.8</a><br><a href="http://service.example.net">service.example.net</a>. 3599 IN A service_server_wan_ip<br></div><div><br></div><div>Can you spot anything wrong with it?<br></div><div>Thanks<br><br><div class="gmail_extra"><font face="courier new,courier,monospace"><span><font size="2"><span style="color:rgb(0,0,51)"></span></font></span></font><br><font face="courier new,courier,monospace"><span><font size="2"><span style="color:rgb(0,0,51)"></span></font></span></font><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div class="gmail_quote">On 19 April 2017 at 09:37, Tony Finch <span dir="ltr"><<a href="mailto:dot@dotat.at" target="_blank">dot@dotat.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-">Alberto Rinaudo <<a href="mailto:alberto.rinaudo@gmail.com">alberto.rinaudo@gmail.com</a>> wrote:<br>
<br>
> I have a bind installation on a aws server and I'm trying to set up views<br>
> to give different responses based on the source location.<br>
><br>
> It works fine when this dns server is the first dns used by a client, I<br>
> guess because the source address used to discriminate between views is the<br>
> last hop.<br>
><br>
> If the query goes first to google dns instead I end up in the wrong view.<br>
><br>
> So here's the question: is it possible to use the original source address<br>
> to chose the view?<br>
<br>
</span>This is what the EDNS client subnet option is about. You can use it in<br>
BIND by adding "ecs" clauses to your address match lists for views or<br>
acls. However it isn't documented in the ARM and it has significant<br>
problems. See<br>
<a href="https://kb.isc.org/article/AA-01432/0/BIND-9.11.0-Release-Notes.html" rel="noreferrer" target="_blank">https://kb.isc.org/article/AA-<wbr>01432/0/BIND-9.11.0-Release-<wbr>Notes.html</a><br>
and especially<br>
<a href="https://kb.isc.org/article/AA-01480/0/BIND-9.11.1rc3-Release-Notes.html" rel="noreferrer" target="_blank">https://kb.isc.org/article/AA-<wbr>01480/0/BIND-9.11.1rc3-<wbr>Release-Notes.html</a><br>
<br>
EDNS client subnet specification:<br>
<a href="https://tools.ietf.org/html/rfc7871" rel="noreferrer" target="_blank">https://tools.ietf.org/html/<wbr>rfc7871</a><br>
<br>
Google Public DNS support for ECS on authoritative servers:<br>
<a href="https://groups.google.com/forum/#%21topic/public-dns-announce/67oxFjSLeUM" rel="noreferrer" target="_blank">https://groups.google.com/<wbr>forum/#!topic/public-dns-<wbr>announce/67oxFjSLeUM</a><br>
<span class="gmail-HOEnZb"><font color="#888888"><br>
Tony.<br>
--<br>
f.anthony.n.finch <<a href="mailto:dot@dotat.at">dot@dotat.at</a>> <a href="http://dotat.at/" rel="noreferrer" target="_blank">http://dotat.at/</a> - I xn--zr8h punycode<br>
Viking, North Utsire: Southwesterly 5 or 6, decreasing 4 at times. Slight or<br>
moderate. Rain at times. Good, occasionally poor.<br>
</font></span></blockquote></div></div></div></div></div></div></div></div></div></div></div></div></div><br></div></div></div>