<div dir="ltr">Dear Mathus, thanks al lot for your help.<div><br></div><div><span style="color:rgb(80,0,80)">>> what is the point of running DNS server with only two hostnames allowed to</span><br style="color:rgb(80,0,80)"><span style="color:rgb(80,0,80)">>> resolve?</span> </div><div><br></div><div>The point is I have several desktops that must have access only to internal domains. The unique exception is they have access to <a href="http://teamviewer.com">teamviewer.com</a> in order to download the Teamviewer client and a pair of operations in this public domain.<br></div><div><br></div><div>I think if I have setup "recursion = no", if I define a forward zone with "type forward" and the corresponding forwarder, this option enable the recursion just for this defined zone.</div><div><br></div><div>In general, my question is how to forward a public domain to a DNS resolver like 8.8.8.8 ???</div><div><br></div><div>Thanks again.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">El sáb., 9 feb. 2019 a las 12:28, Matus UHLAR - fantomas (<<a href="mailto:uhlar@fantomas.sk">uhlar@fantomas.sk</a>>) escribió:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 07.02.19 16:30, Roberto Carna wrote:<br>
>Desktops I mentioned can only access to web apps from internal domains, but<br>
>in some web apps there are links to download Teamviewer client software<br>
>from Internet. I can create a private zone "<a href="http://teamviewer.com" rel="noreferrer" target="_blank">teamviewer.com</a>" with all the<br>
>hostnames and IP's we will use, but if they change I will be in trouble.<br>
><br>
>So we need to forward the query to our resolvers in order to get a valid<br>
>response.<br>
><br>
>So I think we can use the forward option from BIND, but it doesn't work at<br>
>all as I described:<br>
><br>
>1. "recursion no" can only be set at the top (view) level, not overridden<br>
> at the zone level.<br>
><br>
>2. If I set "recursion no" at the view level, then a "type forward"<br>
> zone has no effect:<br>
><br>
> view "foo" {<br>
> recursion no;<br>
> ...<br>
> zone "<a href="http://teamviewer.com" rel="noreferrer" target="_blank">teamviewer.com</a>" {<br>
> type forward;<br>
> forward only;<br>
> forwarders {172.18.1.1; 172.18.1.2;};<br>
> };<br>
><br>
>-- query for <a href="http://foo.teamviewer.com" rel="noreferrer" target="_blank">foo.teamviewer.com</a> fails and tell it's not a recursive query<br>
<br>
the whole point of "recursion no" is not to answer recursive queries,<br>
so there should be no wonder it works that way.<br>
<br>
<br>
>3. If I define "recursion yes" at view level:<br>
><br>
> view "foo" {<br>
> recursion yes;<br>
> ...<br>
> zone "<a href="http://teamviewer.com" rel="noreferrer" target="_blank">teamviewer.com</a>" {<br>
> type forward;<br>
> forward only;<br>
> forwarders {172.18.1.1; 172.18.1.2;};<br>
> };<br>
><br>
>-- query for <a href="http://foo.teamviewer.com" rel="noreferrer" target="_blank">foo.teamviewer.com</a> is OK, but also I get response OK from<br>
><a href="http://foo.ibm.com" rel="noreferrer" target="_blank">foo.ibm.com</a>, <a href="http://foo.google.com" rel="noreferrer" target="_blank">foo.google.com</a>, and any other public domain from Internet<br>
>(and this is not what I want, it's what I'm trying to prevent))<br>
><br>
>So can you help me please???<br>
<br>
you still have not answered my question:<br>
<br>
>> what is the point of running DNS server with only two hostnames allowed to<br>
>> resolve?<br>
<br>
However, you can define empty type master "." zone, and bind will return<br>
NXDOMAIN for anything other.<br>
<br>
<br>
>El jue., 7 feb. 2019 a las 15:40, Matus UHLAR - fantomas (<<a href="mailto:uhlar@fantomas.sk" target="_blank">uhlar@fantomas.sk</a>>)<br>
>escribió:<br>
><br>
>> On 07.02.19 14:58, Roberto Carna wrote:<br>
>> >In our company we have several desktops from two different cities<br>
>> accessing<br>
>> >only to internal domains distributed in two views in a private BIND with<br>
>> >authoritative zones, where I've defined "recursion no;".<br>
>> ><br>
>> >But now we have to let them access to *.<a href="http://teamviewer.com" rel="noreferrer" target="_blank">teamviewer.com</a> hostnames, just<br>
>> this<br>
>> >public domain and not other.<br>
>><br>
>> btw, when did <a href="http://linux.org" rel="noreferrer" target="_blank">linux.org</a> change to <a href="http://teamviewer.com" rel="noreferrer" target="_blank">teamviewer.com</a>?<br>
>><br>
>> >So I've implemented the forwarding of "<a href="http://teamviewer.com" rel="noreferrer" target="_blank">teamviewer.com</a>" zone to our BIND<br>
>> >resolvers servers (they forward DNS queries to 8.8.8.8). So I've created a<br>
>> >third view with this information in named.conf.local:<br>
>> ><br>
>> >acl internet { <a href="http://10.0.0.0/24" rel="noreferrer" target="_blank">10.0.0.0/24</a> };<br>
>> ><br>
>> >view "internet" {<br>
>> ><br>
>> > match-clients { internet; key "custom"; };<br>
>> ><br>
>> > recursion yes;<br>
>> ><br>
>> > zone "<a href="http://teamviewer.com" rel="noreferrer" target="_blank">teamviewer.com</a>" {<br>
>> ><br>
>> > type forward;<br>
>> ><br>
>> > forward only;<br>
>> ><br>
>> > forwarders {<br>
>> ><br>
>> > 172.18.1.1;<br>
>> ><br>
>> > 172.18.1.2;<br>
>> ><br>
>> > };<br>
>> ><br>
>> >};<br>
>><br>
>><br>
>> >I defined "recursion yes" but the BIND servers forwards all the public<br>
>> >domains queries to our resolvers and not just for "<a href="http://teamviewer.com" rel="noreferrer" target="_blank">teamviewer.com</a>", so it<br>
>> >doesn't work. And if I change for "recursion no", the query<br>
>> ><a href="http://www.teamviewer.com" rel="noreferrer" target="_blank">www.teamviewer.com</a> is refused and at the client side appears an error<br>
>> >telling that recursion is necessary.<br>
>><br>
>> of course, BIND will resolve other domains (recurse) only when you allow it<br>
>> to recurse.<br>
>><br>
>> >So I let desktops resolve all the Internet domains or neither, and this is<br>
>> >not what I want because I just want to let them resolve just<br>
>> <a href="http://teamviewer.com" rel="noreferrer" target="_blank">teamviewer.com</a>.<br>
>> ><br>
>> >How can I do to forward only <a href="http://teamviewer.com" rel="noreferrer" target="_blank">teamviewer.com</a> zone queries to my<br>
>> resolvers???<br>
>><br>
<br>
-- <br>
Matus UHLAR - fantomas, <a href="mailto:uhlar@fantomas.sk" target="_blank">uhlar@fantomas.sk</a> ; <a href="http://www.fantomas.sk/" rel="noreferrer" target="_blank">http://www.fantomas.sk/</a><br>
Warning: I wish NOT to receive e-mail advertising to this address.<br>
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.<br>
Eagles may soar, but weasels don't get sucked into jet engines. <br>
_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</blockquote></div>