You can also do it by IP in views but need separate IPs for each view. You can do that with virtual IPs on the same NICs as the primary IPs. Such virtual IPs of course have to be in the same subnet as the primary and also you’d need to insure firewall (including host level if any) is opened for the new IPs.
________________________________ From: bind-users-bounces+jlightner=water....@lists.isc.org [mailto:bind-users-bounces+jlightner=water....@lists.isc.org] On Behalf Of Eric Chandler Sent: Monday, April 16, 2012 11:47 AM To: bind-users@lists.isc.org Subject: RE: Split DNS and zone transfers I’ve been pointed to the right place to figure this out. The answer is in using TSIG. That saved me a lot of time. I searched everywhere but the most-obvious place – the bind9 faq. Eric Chandler Systems Architect From: bind-users-bounces+eric.chandler=vonage....@lists.isc.org [mailto:bind-users-bounces+eric.chandler=vonage....@lists.isc.org] On Behalf Of Eric Chandler Sent: Monday, April 16, 2012 11:36 AM To: bind-users@lists.isc.org Subject: Split DNS and zone transfers I have a situation where I need to filter out our private infrastructure from our public-facing DNS servers. This is certainly something that should have been done a long time ago, but I just recently took over the spot. Now, I’ve seen plenty of examples using views and separate zonefiles, but what I can’t find are examples of the same domain zone-xfering both zonefiles. Our DNS infrastructure is large and the configuration varies from server type to server type. Some are configured to be the primary auth servers – facing the Internet. Others are public-facing, but accessed only by customer devices, and still others service our internal systems. I would like to get us down to just 1 set of configuration files across the board, using views as the way to do it, but what I can’t get around are split zone transfers. In this example, we have a straightforward example of a split zone: view "trusted" { match-clients { 192.168.23.0/24; }; // our network recursion yes; // other view statements as required zone "example.com" { type master; // private zone file including local hosts file "internal/master.example.com<http://www.zytrax.com/books/dns/ch6/mydomain-internal.html>"; }; // add required zones }; view "badguys" { match-clients {"any"; }; // all other hosts // recursion not supported recursion no; // other view statements as required zone "example.com" { type master; // public only hosts file "external/master.example.com<http://www.zytrax.com/books/dns/ch6/mydomain-external.html>"; }; // add required zones }; Now, what I would like to have are slave servers that would zone-xfer both the internal and external-flavored files for example.com and serve them using the same view structure. The hidden masters can generate the split zone files based on private IP address ranges, but I see no way to use zone transfers to get both types of files replicated to the many slave servers that I would need to get them to. This obviously won’t work, but this is what I’m after from a logical sense. view "trusted" { match-clients { 192.168.23.0/24; }; // our network recursion yes; // other view statements as required zone "example.com" { type slave; masters = { 1.2.3.4, 4.5.6.7 }; // private zone file including local hosts file "internal/master.example.com<http://www.zytrax.com/books/dns/ch6/mydomain-internal.html>"; }; // add required zones }; view "badguys" { match-clients {"any"; }; // all other hosts // recursion not supported recursion no; // other view statements as required zone "example.com" { type slave; masters = { 1.2.3.4, 4.5.6.7 }; // public only hosts file "external/master.example.com<http://www.zytrax.com/books/dns/ch6/mydomain-external.html>"; }; // add required zones }; I suppose I could set up another pair of hidden masters to serve up the internal zones, or another pair of IP addrs on the masters, but I’m hoping not to go down that road. Thanks, Eric Chandler Systems Architect [Description: cid:image009.gif@01CB4E82.96E92D50] 23 Main Street, Holmdel, NJ 07733 •: 732.203.7437 •: 732.284.8504 (iPhone) •: eric.chand...@vonage.com<mailto:eric.chand...@vonage.com> þ: www.vonage.com<http://www.vonage.com/> [Description: cid:image010.jpg@01CB4E82.96E92D50] NOTE: The information contained in this email message is considered confidential and proprietary to the sender and is intended solely for review and use by the named recipient. Any unauthorized review, use or distribution is strictly prohibited. If you have received this message in error, please advise the sender by reply email and delete the message Athena®, Created for the Cause™ Making a Difference in the Fight Against Breast Cancer How and Why I Should Support Bottled Water! Do not relinquish your right to choose bottled water as a healthy alternative to beverages that contain sugar, calories, etc. Your support of bottled water will make a difference! Your signatures count! Go to http://www.bottledwatermatters.org/luv-bottledwater-iframe/dswaters and sign a petition to support your right to always choose bottled water. Help fight federal and state issues, such as bottle deposits (or taxes) and organizations that want to ban the sale of bottled water. Support community curbside recycling programs. Support bottled water as a healthy way to maintain proper hydration. Our goal is 50,000 signatures. Share this petition with your friends and family today! --------------------------------- CONFIDENTIALITY NOTICE: This e-mail may contain privileged or confidential information and is for the sole use of the intended recipient(s). If you are not the intended recipient, any disclosure, copying, distribution, or use of the contents of this information is prohibited and may be unlawful. If you have received this electronic transmission in error, please reply immediately to the sender that you have received the message in error, and delete it. Thank you. ----------------------------------
<<inline: image001.gif>>
<<inline: image002.jpg>>
_______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
