Master – Slave Split DNS

Home » CentOS » Master – Slave Split DNS
CentOS 10 Comments

Hi folks,

I’ve already configured split DNS for internal-view and external-view. Also already configured the master – slave dns. But i’ve problem with external-view zone transfer. Based on the logs, the master notify to slave using the public ip, which is not accessible by master to transfering the zone over public ip. Is it possible to transfer zone over local ip for external-view ?

Thanks.

10 thoughts on - Master – Slave Split DNS

  • Been a while since I did this, but as I recall I had to set up a second local IP address to transfer the external zone files so it could distinguish between the internal and external requests. HTH

  • Am 18.02.2015 um 08:17 schrieb aditya hilman :

    add to your external view

    allow-notify { local ip; };

  • Hi Adit,

    If you are not already using TSIG’s in your views I suggest you look at this guide http://blog.hudecof.net/posts/2014/02/07/bind9-with-views-and-tsig-axfr.html It shows how to use TSIG’s to identify the views so you can slave both of them to the secondary.

    also you want to add to the options section on the master also-notify { slaves-IP; };
    This make it tell the slave to update its zone.

    Tris

    *************************************************************
    This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify postmaster@bgfl.org

    The views expressed within this email are those of the individual, and not necessarily those of the organisation
    *************************************************************

  • Hi folks,

    Below the named.conf and logs when transfer zone the external-view. Transfer zone for the internal-view is working properly.

    named.conf view “internal-view” {
    match-clients { internal; };

    zone “.” IN {
    type hint;
    file “named.ca”;
    };

    # domain zone
    zone “domain.com” {
    type master;
    file “domain.com.internal”;
    allow-transfer { 10.xx.xx.xx; 10.xx.xx.xx; };
    notify yes;
    also-notify { 10.xx.xx.xx; 10.xx.xx.xx; };
    };
    }

    view “external-view” {
    match-clients { any; };

    zone “.” IN {
    type hint;
    file “named.ca”;
    };

    # domain zone
    zone “domain.com” {
    type master;
    file “domain.com.external”;
    allow-transfer { 10.xx.xx.xx; 10.xx.xx.xx; };
    notify yes;
    also-notify { 10.xx.xx.xx; 10.xx.xx.xx; };
    };
    }

    18-Feb-2015 09:00:59.176 notify: debug 2: zone domain.com/IN/external-view:
    notify to 202.xx.xx.xx#53 failed: timed out

    Can i redirect transfer zone the external-view using the local ip
    10.xx.xx.xx ?

    Thanks.

  • Am 20.02.2015 um 05:07 schrieb aditya hilman:

    That’s just normal network handling: NATting / masquerading the RFC1918
    address space for routing in the public address space. Nothing bind does itself.

    Alexander

  • Hi folks,

    After configure the iptables for masquerade the zone transfer traffic. I’ve found new issue, below the log on slave :

    zone domain.com/IN/external-view: serial number (2015022302) received from master 10.xx.xx.xx#53 < ours (2015022303) The zone on the slave doesn’t update. Thanks.

  • The reason the zone does not update is given in the message. The serial number on the slave copy of the zone file is greater than the serial number on the master’s copy. You need to figure out why that is so and fix that issue. Then the slave should update.