<html>Hello folks!<br /><br />Clark,<br /><br />Thanks for explanation, I think it makes really sense. I''m gonna perform more tests to try clarify exactly what is it.<br /><br />Thankful<br />--<br /><br /><font size="3"><b>Miguel Moreira</b><br />Gerente</font><br /><font size="3">DPR/SRE/GSR - Gerência de Serviços de Rede<br />+55(31)3339-1401<br />PRODEMGE - Companhia de Tecnologia da Informação do Estado de Minas Gerais</font><br /><br /><br /><font size="2">Aviso: Esta mensagem é destinada exclusivamente para a(s) pessoa(s) a quem é dirigida, podendo conter informação sigilosa e legalmente protegida. O uso impróprio será tratado conforme as normas da empresa e a legislação em vigor. Caso não seja o destinatário, favor notificar o remetente, ficando proibidas a utilização, divulgação, cópia e distribuição.</font> Em Terça, Março 26, 2019 02:15 -03, Crist Clark <cjc+bind-users@pumpky.net> escreveu:<blockquote type="cite" cite="CAAcrURLP0XT0GXj9WawNyeGs6SnZmi-zC4_W4KFwUb74mhBNSg@mail.gmail.com">In order to make the determination whether to apply an rpz-nsip rule,<br />the DNS server must have the NS records and their corresponding A<br />records. In a recursive resolver, it would have had to lookup said NS<br />and A records to find the answer to the query, so they are cached and<br />available. In a forwarding resolver, it does not need to look up the<br />intermediate NS records to answer the query. It does not have the NS<br />records available.<br /><br />You basically need your forwarder to act like a recursive resolver in<br />order for it to get the info in needs. Looks like BIND follows its<br />directive to be a forwarder as the higher calling, and doesn't do the<br />extra look ups necessary to get the answers it could use for the RPZ<br />policies. However, if they are cached and available, it will go ahead<br />and use them.<br /><br />I think the right answer is that if you want full capabilities for<br />RPZ, you need full recursive resolver functionality.<br /><br />(Just a BIND user explaining how I understand these features to work.<br />I may be way off. Also, you should be sure to read the following if<br />you have not already. I may not be correctly understanding your<br />explanation, and this document is specifically about limitations and<br />unexpected behaviors of this functionality,<br />https://kb.isc.org/docs/aa-00862<br />)<br /><br />On Mon, Mar 25, 2019 at 4:45 PM Miguel Mucio Santos Moreira<br /><miguel@prodemge.gov.br> wrote:<br />><br />> Lee, thanks for your quick answer.<br />> I applied the policy based on rpz-nsip trigger instead of mg.gov.br QNAME because of some others situations in my environment. Like I said earlier, the doubt is why when there's no forward zone the trigger works properly? In my opinion it should'nt have different behaviour just because of forward zone, at least I can't imagine why this is happening.<br />> The Bind version deployed is 9.11.4, I was imagining It could be a bug, and It seems bind 9.12 version has a fix related to this problem, but I'm not sure.<br />><br />> thanks one more time.<br />><br />><br />><br />> Miguel Moreira<br />> Gerente<br />> DPR/SRE/GSR - Gerência de Serviços de Rede<br />> +55(31)3339-1401<br />> PRODEMGE - Companhia de Tecnologia da Informação do Estado de Minas Gerais<br />><br />><br />> Aviso: Esta mensagem é destinada exclusivamente para a(s) pessoa(s) a quem é dirigida, podendo conter informação sigilosa e legalmente protegida. O uso impróprio será tratado conforme as normas da empresa e a legislação em vigor. Caso não seja o destinatário, favor notificar o remetente, ficando proibidas a utilização, divulgação, cópia e distribuição. Em Segunda, Março 25, 2019 18:37 -03, Lee <ler762@gmail.com> escreveu:<br />><br />> On 3/25/19, Miguel Mucio Santos Moreira wrote:<br />> ><br />> > Hello everybody!<br />><br />> Hi!<br />><br />> > I have a problem with DNS-RPZ and forward zone working together.<br />> > I've created a rpz zone with the following trigger on my recursive DNS<br />> > Server:<br />> > 18.0.0.198.200.rpz-nsip IN CNAME rpz-passthru.<br />><br />> Which means anybody can answer with a 200.198.0.0/18 address and it<br />> will be accepted. .. probably not what you want.<br />><br />> > It means any query response comming from a DNS Server which IP address<br />> > matching with the any IP address at entire CIDR block 200.198.0.0/18 will be<br />> > answered with rpz-passthru<br />> > It works perfectly for any domain hosted in my Authoritative DNS Servers.<br />> > But when I apply on my recursive RPZ DNS Server a forward zone for those<br />> > domains hosted on my Authoritative DNS Servers the problems appear and it is<br />> > very weird.<br />> ><br />> > I have a mg.gov.br domain<br />><br />> I'd go with<br />><br />> mg.gov.br IN CNAME rpz-passthru.<br />> -- it's your domain so hopefully you can trust whatever answers it gives<br />> 18.0.0.198.200.rpz-nsip IN CNAME .<br />> -- nobody else gets to answer with your address space<br />><br />> Regards,<br />> Lee<br />><br />> > and its NS Servers are zeus.prodemge.gov.br<br />> > (200.198.5.13), titanio.prodemge.gov.br (200.198.5.5), tupan.prodemge.gov.br<br />> > (200.198.4.4) and jupiter.prodemge.gov.br (200.198.5.2).<br />> > If I perform a dig at my workstation using Recursive DNS with RPZ looking<br />> > for any record in mg.gov.br domain, rpz-passthru policy is not applied,<br />> > however if I perform a dig looking for any record in prodemge.gov.br domain<br />> > and after that I perform the same dig before it works properly.<br />> ><br />> ><br />> > Note: Recursive DNS Servers and Authoritative DNS Servers are not the same.<br />> ><br />> > As workaround solution I applied 4 rpz-nsdname triggers above that one<br />> > mentioned in the begining this email with my authoritative name servers with<br />> > rpz-passthru policy.<br />> > titanio.prodemge.gov.br.rpz-nsdname IN CNAME rpz-passthru.<br />> > jupiter.prodemge.gov.br.rpz-nsdname IN CNAME rpz-passthru.<br />> > tupan.prodemge.gov.br.rpz-nsdname IN CNAME rpz-passthru.<br />> > zeus.prodemge.gov.br.rpz-nsdname IN CNAME rpz-passthru.<br />> ><br />> > I would like to understand why it didn't work without workaround solution,<br />> > anyone has any idea about it?<br />> ><br />> > Thanks in advance<br />> > --<br />> ><br />> > Miguel Moreira<br />> > Gerente<br />> > DPR/SRE/GSR - Gerência de Serviços de Rede<br />> > +55(31)3339-1401<br />> > PRODEMGE - Companhia de Tecnologia da Informação do Estado de Minas Gerais<br />> ><br />> ><br />> > Aviso: Esta mensagem é destinada exclusivamente para a(s) pessoa(s) a quem é<br />> > dirigida, podendo conter informação sigilosa e legalmente protegida. O uso<br />> > impróprio será tratado conforme as normas da empresa e a legislação em<br />> > vigor. Caso não seja o destinatário, favor notificar o remetente, ficando<br />> > proibidas a utilização, divulgação, cópia e distribuição.<br />> ><br />><br />> _______________________________________________<br />> Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list<br />><br />> bind-users mailing list<br />> bind-users@lists.isc.org<br />> https://lists.isc.org/mailman/listinfo/bind-users</blockquote></html>