You have only specified yourself as a recolving DNS server... and the
configuration you have shown does not permit anyone (including yourself)
to do recursion... thus, you will resolve domains for which you are a
master server for, but nothing else (which is the RIGHT configuration
for the Internet-facing DNS service).
Here's how I do it...
In $ROOTDIR/etc/named.conf you'll see the following (this is only a
PARTIAL listing):
acl locals {
127.0.0.0/8; // loopbacks
192.168.0.0/24; // My local LAN -- you may not need
this
};
...
view "authorized" {
match-clients { locals; };
recursion yes;
include "basic.zones";
include "local.zones";
include "master.zones";
include "slave.zones";
};
view "unauthorized" {
match-clients { any; };
recursion no;
include "master.zones";
include "slave.zones";
};
So then the operative question becomes, what's in those include files!
*basic.zones *has the root-hints, plus the definitions for localdomain,
localhost, etc that you'll see in any sample BIND config
*local.zones *has the zone definitions for my local (intermal, LAN)
zones (e.g.: mydomain.local)
*master.zones *has the zone definitions for zones that this server is
the MASTER server for (that is, REAL zones that I am authoritative for)
*slave.zones *has the zone definitions for zones that this server is a
SLAVE server for
Now any of these *.zones files can be EMPTY (for example, on my real
MASTER DNS server, master.zones has some 200 entries for domains I host,
and an empty slave.zones file -- and my slave DNS servers have empty
master.zones files, but 200 entries in the slave.zones files)
The end result is that my internal LAN clients (those with an address of
192.168.0.x) have use of my BIND service for looking up external names
(like google.com), as well as internal (like domain.local) and even my
own "public" domain names.... but outsiders (any other IP address) can
only see my "public" domain names -- they cannot resolve ANY name other
than those for which I am an authoritative server....
At least that's the issue I THING you're having...
Good Luck
Dan
IT4SOHO
On 8/6/2011 11:04 PM, Maxwell Smart wrote:
Scott Hughes wrote:
For some weird reason my DNS (not on qmail) is not forwarding
requests for zones that aren't in it's zone files (like google.com
<http://google.com>). If I 'dig' one of my zones, I get all the
correct information. If I 'dig' something like www.google.com
<http://www.google.com> I get nothing. Here are the two files that I
think control this:
# cat resolv.conf
search renshawauto.org <http://renshawauto.org>
nameserver 66.255.244.213
nameserver 127.0.0.1
NOTE: Both of these IPs are the same interface. I used to just have
the 127.0.0.1 and nothing else, so I tried the live IP to see if that
would help
# cat named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND
named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver
only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration
files.
//
options {
listen-on port 53 { 127.0.0.1; };
listen-on port 53 { 66.255.244.213; };
# listen-on-v6 port 53 { ::1; };
allow-query { 127.0.0.1; 66.255.244.213; };
allow-recursion { 127.0.0.1; 66.255.244.213; };
directory "/var/named/chroot/var/named";
forward first;
forwarders { 8.8.8.8; 8.8.4.4; };
dump-file "/var/named/chroot/var/named/data/cache_dump.db";
statistics-file
"/var/named/chroot/var/named/data/named_stats.txt";
memstatistics-file
"/var/named/chroot/var/named/data/named_mem_stats.txt";
// allow-query { 127.0.0.1; 66.255.244.213; localhost; };
recursion no;
transfers-out 100;
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "/var/named/chroot/var/named/named.root";
};
include "/var/named/chroot/etc/named.conf.local";
Any ideas? I've been searching on Google for HOURS on this one. I
even replaced my named.root file with the latest from Internic, No
Joy! If I put an outside DNS server into the resolv.conf then it
will work probably, but the forwarders in the named.conf should do this!
Thanks,
Scott
Firewall port 53 open?
--
Cecil Yother, Jr. "cj"
cj's
2318 Clement Ave
Alameda, CA 94501
tel 510.865.2787
http://yother.com
Check out the new Volvo classified resourcehttp://www.volvoclassified.com
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com) Vickers Consulting Group offers
Qmailtoaster support and installations. If you need professional help
with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and
packages. To unsubscribe, e-mail:
[email protected] For additional
commands, e-mail: [email protected]
