Skip to main content

domain name system - Internal and External DNS from Different Servers, Same Zone



I am either having trouble understanding how DNS works, or I am having trouble configuring my DNS correctly (either one isn't good). I am currently working with a domain, I'll call it webdomain.com, and I need to allow all of our internal users to get out to dotster to get our public DNS entries just like the rest of the world. Then, on top of that, I want to be able to supply just a few override DNS entries for testing servers and equipment that is not available publically. As an example:




  • public.webdomain.com - should get this from dotster

  • outside.webdomain.com - should get this from dotster as well


  • testing.webdomain.com - should get this from my internal dns controller





The problem that I seem to be running into at every turn is that if I have an internal DNS controller that contains a zone for webdomain.com then I can get my specified internal entries but never get anything from the public DNS server. This holds true regardless of the type of DNS server I use also--I have tried both a Linux Bind9 and a Windows 2008 Domain Controller.



I guess my big question is: am I being unreasonable to think that a system should be able to check my specified internal DNS and in the case where a requested entry doesn't exist it should fail over to the specified public dns server -OR- is this just not the way DNS works and I am lost in the sauce?



It seems like it should be as simple as telling my internal DNS server to forward any requests that it can't fulfill to dotster, but that doesn't seem to work. Could this be a firewall issue?



Thanks in advance




EXTENDED



OK, so I did a bunch of research and have been plugging at this for a few hours. I have this in my named.conf and I am STILL seeing the same result. Internal calls are fed, but anything external (in the zone controlled domain) is just dumped. Any assistance would be great! Also, this is an Ubuntu 9.04 OS I am working with.



Code removed because it was wrong.


THE CORRECT WAY -- ADDED AFTER QUESTION CLOSED



Well, thanks to the folks here on serverfault I now have this working perfectly on my server and in a much more succinct fashion. Here is how you do it. From a base install of bind9 edit your named.conf.local file and add in a zone for EACH subdomain that you want to redirect:




/etc/bind/named.conf



// WEBDOMAIN.COM ENTRIES
    zone "test.webdomain.com" {
            type master;
            file "/etc/bind/zones/test.webdomain.com";
    };

    zone "alpha.webdomain.com" {

            type master;
            file "/etc/bind/zones/alpha.webdomain.com";
    };

    zone "beta.webdomain.com" {
            type master;
            file "/etc/bind/zones/beta.webdomain.com";
    };

// INTERNETSITE.COM ENTRIES

    zone "internal.internetsite.com" {
            type master;
            file "/etc/bind/zones/internal.internetsite.com";
    };

    zone "dev.internetsite.com" {
            type master;
            file "/etc/bind/zones/dev.internetsite.com";
    };



Edit your /etc/bind/named.conf.options file and add any forwarders you want to use into the correct location:



/etc/bind/named.conf.options



options {
        directory "/var/cache/bind";

        forwarders {
                208.67.222.222;

                208.67.220.220;
                8.8.8.8;
                8.8.4.4;
        };

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
};



Create a new folder called zones at /etc/bind/zones/ and add a new file for EACH of the zones you created above that match the 'file' attribute above. Using test.webdomain.com as an example:



/etc/bind/zones/test.webdomain.com



$TTL    604800
@       IN      SOA     test.webdomain.com. (
                              1         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire

                         604800 )       ; Negative Cache TTL
;
@                       IN      NS      test.webdomain.com.
test.webdomain.com.    IN      A       10.0.1.20


Where 10.0.1.20 is the A record ip address that you want this (sub)domain to forward to. By doing it this way the record for test.webdomain.com is authoritative for only the subdomain and the global DNS will supply any other subdomains or root domains as usual.


Answer



What you'll want to do is create a DNS zone for testing.webdomain.com on your internal DNS server. This way the webdomain.com DNS isn't hosted by your internal server, but is instead hosted by dotster.




When someone queries for www.webdomain.com the request will be forwarded to dotster for the lookup (since your local DNS server isn't authoritative for that zone), while requests for testing.webdomain.com will be handled by your internal DNS server.


Comments

Post a Comment

Popular posts from this blog

linux - iDRAC6 Virtual Media native library cannot be loaded

When attempting to mount Virtual Media on a iDRAC6 IP KVM session I get the following error: I'm using Ubuntu 9.04 and: $ javaws -version Java(TM) Web Start 1.6.0_16 $ uname -a Linux aud22419-linux 2.6.28-15-generic #51-Ubuntu SMP Mon Aug 31 13:39:06 UTC 2009 x86_64 GNU/Linux $ firefox -version Mozilla Firefox 3.0.14, Copyright (c) 1998 - 2009 mozilla.org On Windows + IE it (unsurprisingly) works. I've just gotten off the phone with the Dell tech support and I was told it is known to work on Linux + Firefox, albeit Ubuntu is not supported (by Dell, that is). Has anyone out there managed to mount virtual media in the same scenario?
Post a Comment
Read more

ubuntu - Monitoring CPU, Mem, disk, on a single server

I've been looking for a simple starter solution for monitoring my [currently] single server hosted solution. Other than Nagios and similar, are there other good (simple) solutions people are using? Answer Everything depends on what you want. For example Munin is very simple, you can install and configure it in less then 10 minutes (on one server), it can sends alarms, make graphs from monitoring cpu, mem. apache connections, eaccellerator, disk io and many many more (it has many plugins). But if you are planning in future get some more machines, munin may not be enough. For example in munin you cant monitor state of individual processes, can't monitor changes in files (for security purpose). So if you wanna only see what is the utilization of basics parameters on your server and don't plan to buy some more servers Munin is what you are looking for, but if you wanna be alarmed when some of your service is down, take more control on what is happeninig on...
Post a Comment
Read more

hp proliant - Smart Array P822 with HBA Mode?

We get an HP DL360 G8 with an Smart Array P822 controller. On that controller will come a HP StorageWorks D2700 . Does anybody know, that it is possible to run the Smart Array P822 in HBA mode? I found only information about the P410i, who can run HBA. If this is not supported, what you think about the LSI 9207-8e controller? Will this fit good in that setup? The Hardware we get is used but all original from HP. The StorageWorks has 25 x 900 GB SAS 10K disks. Because the disks are not new I would like to use only 22 for raid6, and the rest for spare (I need to see if the disk count is optimal or not for zfs). It would be nice if I'm not stick to SAS in future. As OS I would like to install debian stretch with zfs 0.71 as file system and software raid. I have see that hp has an page for debian to. I would like to use hba mode because it is recommend, that zfs know at most as possible about the disk, and I'm independent from the raid controller. For us zfs have many benefits, ...
Post a Comment
Read more