[4350] in RedHat Linux List
Re: DNS - forwarders question
daemon@ATHENA.MIT.EDU (Jeff Hutchison)
Thu Nov 14 11:36:22 1996
Date: Thu, 14 Nov 1996 11:01:32 -0500 (EST)
From: Jeff Hutchison <jhut@inst.strykercorp.com>
Reply-To: Jeff Hutchison <jhut@inst.strykercorp.com>
To: redhat-list@redhat.com
In-Reply-To: <199611141032.FAA01359@marathon.infi.net>
Resent-From: redhat-list@redhat.com
My setup is very similar to yours and works great. I use a dual DNS setup
that was described to me at a Firewall tutorial I attended at LISA96. I've
modified your drawing below:
On Thu, 14 Nov 1996, Jeff Douglass wrote:
>
> Network setup:
>
> [external_DNS_1] [external_DNS_2]
> 38.23.12.1 38.25.12.1
> | |
> | |
> ------------------------
> |
> |
> 33.33.33.1
> [Red Hat 4.0 firewall] resolv.conf --- <-- modified
> 10.0.0.1 |
> | |
> |forwarders, slave |
> 10.0.0.2 |
> [Internal DNS server] <-------------
> |
> |
> [Internal hosts point to 10.0.0.2 in resolv.conf]
>
> What should a forwarders declaration contain if I am setting up an
> internal DNS server on a network secured by RH 4.0 with ipfw? Should
> it be something like:
>
> forwarders 10.0.0.1 38.23.12.1 38.25.12.1
I use this named.boot on the internal name server (changed to match your
firewall address of 10.0.0.1) :
; boot file for manta root nameserver
;
directory /var/named
forwarders 10.0.0.1
slave
;
;type domain source file or host
cache . root.cache
primary 0.0.127.in-addr.arpa pz/127.0.0
primary my.dom.ain pz/my.dom.ain
primary 1.10.in-addr.arpa pz/10.1
All internal hosts point to this server. The root.cache is empty, I probably
don't even need that line in this file.
On the firewall, the resolv.conf points back to the internal DNS server. This
is done so internal hosts are visible to the gateway for mail delivery,
logging, etc. Any address that the internal DNS server doesn't know about is
forwarded to the gateway DNS server which then looks up the address. For
example, suppose that outbound mail arrives at the gateway for foo..com. The
gateway sendmail querys the internal DNS server, the internal server forwards
the request to the gateway DNS server who recursively looks it up. The result
then goes back through the internal DNS server and then finally back to the
gateway sendmail process. Sounds like a lot, but in practice I've found it to
work well on my small to medium sized network- YMMV. This allows us to only
put DNS records in the gateway DNS database that we want visible on the
internet.
>
> Basically, should the firewall appear in the forwarders line? If not
> how is the route established from the internal DNS to the external
> servers?
No route from the external DNS database to the external servers is needed with
this setup.
Jeff Hutchison <jhut@inst.strykercorp.com>
Stryker Instruments
Kalamazoo, MI
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
