I'm a noob when it comes to DNS and BIND9, so forgive me if my description seems pedantic:
I connect to my workplace's network using VPN, which sets me up with the workplace DNS servers. Those servers manage the an internal namespace (visible only to users inside the VPN), with a specific domain name -- lets call it internal.net. Those servers also resolve queries to external addresses (e.g. Google) by forwarding them to some external DNS masters.
Without connecting to the VPN, my DNS lookups are performed via the router (192.168.0.1) which forwards to the ISP DNS server. What I would like to do is do is:
all lookups that don't belong to internal.net should be performed on my ISP's DNS server
all lookups belonging to internal.net are done on the VPN DNS servers
I was able to do this in the past with simply having the /etc/resolv.conf look like:
But the problem is that my ISP recently introduced the annoying DNS redirection "service" where they redirect all unresolved DNS queries to an ad-laden search page, so if I do a lookup on somehost.internal.net, my ISP's DNS will resolve it to their own search page, preventing the use of nameserver 10.0.0.1.
So I figured I could solve this problem by having a local BIND9 instance on my machine that does conditional forwarding based on domain name. The problem is BIND9 configuration seems intimidating and my trials with it have been unsuccessful. Can someone suggest to me a simple BIND9 configuration that achieves my goals?'
I agree you can solve this using BIND9. There is a simple one for such cases, but it's been years. But first, why can't you reverse the order so that the "local" nameserver is searched first?
Hmmm, not sure I understand your question, by local nameserver, do you mean the router's nameserver (192.168.0.1) or do you mean the BIND9 instance I would be setting up on my machine. If it is the former, then I think I already have it such that the local nameserver is searched first:
If it is the latter, then this is exactly why I came here, I don't know how to set up a local BIND9 server with conditional forwarding i.e. a DNS server that forwards all lookups under domain internal.net to 10.0.0.1 and forwards other queries to 192.168.0.1.
What happens if you set all requests to 10.0.0.1 and THEN 192.168.0.1 ? Is it the problem that requests take a long time if there is no such VPN established? This can be solved by routing tables I think.
What happens if you set all requests to 10.0.0.1 and THEN 192.168.0.1 ? Is it the problem that requests take a long time if there is no such VPN established? This can be solved by routing tables I think.
I don't want to set all requests to 10.0.0.1 because that means all my DNS queries will go to my workplace first, and that makes me kind of uncomfortable, since my workplace can and do monitor my traffic.
My problem is that I want all my DNS queries to go my ISP's DNS servers first, then to my work place's. This was possible in the past, but my ISP implemented this annoying "assistive DNS feature" that takes all unresolved DNS queries and routes them to their own search page laden with queries.. that means that as far as my computer is concerned, the DNS query is *resolved* because it was routed to the IP of the ISP's search page. What this means is that:
1- I issue a DNS query for somehost.internal.net (this is a host inside the VPN, the VPN's DNS servers should be able to resolve it, but the ISP's DNS would not be able to resolve it)
2- my query is issued first to the ISP's DNS, which is unable to resolve it. Instead of telling me "sorry, we could not find a match for your DNS name" and let the computer ask alternative DNS servers (like the VPN's DNS), the ISP's DNS instead volunteers and routes me to their own search page.
3- my computer thinks the DNS query resolved fine, and doesn't try the other configured DNS servers.
You don't want to use a secondary nameserver in the system resolver as a form of conditional DNS lookups - the timeouts are too long, and that is not its intended purpose. The purpose is for one of having a backup for the situation when a primary is temporarily offline or unresponsive.
Setup bind with a forward zone for queries to internal.net that query your DNS server of choice. See: "A "forward zone" is a way to configure forwarding" in the BIND reference manual: BIND 9 Administrator Reference Manual
Hi all,
I've a litte problem to get rollerd running and signing my zones if the ZSK of my zones are near expiring or expired.
rollerd is running but do nothing
startet with:
/usr/bin/perl /usr/sbin/rollerd -rrfile /etc/bind/all.rollrec -directory /etc/bind -logfile /dev/stdout
... (1 Reply)
We're moving an app from a server in our domain to a server hosted by the vendor in their domain.
This app had it's own domain setup that we're authoritative for.
Do I need to create a new zone file? zone-vendor_com and set up the CNAME records in this file? Or if I can just edit the one I... (1 Reply)
how can i set default permission for nslookup,
i have in my nslookup
timeout = 0 retry = 3 port = 53
but i want to set it to :
timeout = 2 retry = 2 port = 53
i'm using bind9 , where can i set the default timeout for it?
thanks in advance (0 Replies)
I have configured a Bind9 DNS on a X4270 machine with Solaris10
I am excuting some repformance tests with DNSPERF tool and maximun CPU usage is 23%. I have seen with
prstat -L -p PID
that named process usses only 2 of the 8 available CPU at the same time although threads for all CPUs exist.... (2 Replies)
Hi there,
I have the following problem.
I have a Debian server with bind9.
I can also use my ISP DNS server through the internet box (192.168.1.1).
I would like to fool my client workstation to a local machine when they query for one specific hostname within a domain.
I want to let the... (5 Replies)
Hello guys, can anyone help me with the below error I'm getting from bind9? I'm trying to make bind read all the zone info from openldap, I have already created the schema and I've put some info into the ldap. I have also tried to google the error with no success.
I'm aware there is an problem... (1 Reply)
Hi,
from my workplace we use a proxy to connect to the outside world, including external ssh servers.
The problem is that the server is seeing the connection coming from the proxy and knows nothing about the client behind it. The ssh connection itself works fine, but x-forwarding does not work as... (1 Reply)
so we had bind 9.3.0...
we upgraded to 9.5.0 patch 1
we kept the exact same named.conf
now we have a problem that some DMZ server cant do lookups from our DNS slave anymore.
in the named.log we see things like this:
22-Jul-2008 16:05:04.694 security: info: client <our DMZ servers... (2 Replies)
Hi again guys,
It seems this is a global thing affecting all the DNS bind versions prior to July 28 2008. I have my work cut out for me very soon, I see at least a handful of servers in my list that either need to patching or upgrading.
How many of you guys are affected? Anybody successfully... (4 Replies)