I am either having trouble
understanding how DNS works, or I am having trouble configuring my DNS correctly (either
one isn't good). I am currently working with a domain, I'll call it
webdomain.com, and I need to allow all of our internal
users to get out to dotster to get our public DNS entries just like the rest of the
world. Then, on top of that, I want to be able to supply just a few override DNS entries
for testing servers and equipment that is not available publically. As an
example:
- public.webdomain.com
- should get this from
dotster outside.webdomain.com - should get this
from dotster as
welltesting.webdomain.com - should
get this from my internal dns
controller
The
problem that I seem to be running into at every turn is that if I have an internal DNS
controller that contains a zone for webdomain.com then I
can get my specified internal entries but
never get anything from the public DNS server. This holds
true regardless of the type of DNS server I use also--I have tried both a Linux Bind9
and a Windows 2008 Domain Controller.
I guess my
big question is: am I being unreasonable to think that a system should be able to check
my specified internal DNS and in the case where a requested entry doesn't exist it
should fail over to the specified public dns server -OR- is this just not the way DNS
works and I am lost in the sauce?
It seems like
it should be as simple as telling my internal DNS server to forward any requests that it
can't fulfill to dotster, but that doesn't seem to work. Could this be a firewall
issue?
Thanks in
advance
EXTENDED
OK,
so I did a bunch of research and have been plugging at this for a few hours. I have this
in my named.conf and I am STILL seeing the same result. Internal calls are fed, but
anything external (in the zone controlled domain) is just dumped. Any assistance would
be great! Also, this is an Ubuntu 9.04 OS I am working
with.
Code removed because it was
wrong.
THE
CORRECT WAY -- ADDED AFTER QUESTION
CLOSED
Well, thanks to the folks
here on serverfault I now have this working perfectly on my server and in a much more
succinct fashion. Here is how you do it. From a base install of bind9 edit your
named.conf.local file and add in a zone for EACH subdomain that you want to
redirect:
/etc/bind/named.conf
//
WEBDOMAIN.COM ENTRIES
zone "test.webdomain.com" {
type
master;
file "/etc/bind/zones/test.webdomain.com";
};
zone "alpha.webdomain.com" {
type
master;
file "/etc/bind/zones/alpha.webdomain.com";
};
zone "beta.webdomain.com" {
type master;
file "/etc/bind/zones/beta.webdomain.com";
};
//
INTERNETSITE.COM ENTRIES
zone "internal.internetsite.com"
{
type master;
file
"/etc/bind/zones/internal.internetsite.com";
};
zone
"dev.internetsite.com" {
type master;
file
"/etc/bind/zones/dev.internetsite.com";
};
Edit
your /etc/bind/named.conf.options file and add any forwarders you want to use into the
correct
location:
/etc/bind/named.conf.options
options
{
directory "/var/cache/bind";
forwarders {
208.67.222.222;
208.67.220.220;
8.8.8.8;
8.8.4.4;
};
auth-nxdomain no; # conform to
RFC1035
listen-on-v6 { any;
};
};
Create
a new folder called zones at /etc/bind/zones/ and add a new file for EACH of the zones
you created above that match the 'file' attribute above. Using test.webdomain.com as an
example:
/etc/bind/zones/test.webdomain.com
$TTL
604800
@ IN SOA test.webdomain.com. (
1 ; Serial
604800
; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
@ IN NS
test.webdomain.com.
test.webdomain.com. IN A
10.0.1.20
Where
10.0.1.20 is the A record ip address that you want this (sub)domain to forward to. By
doing it this way the record for test.webdomain.com is authoritative for only the
subdomain and the global DNS will supply any other subdomains or root domains as
usual.
Answer
What you'll want to do is create a DNS zone
for testing.webdomain.com on your internal DNS server. This way the webdomain.com DNS
isn't hosted by your internal server, but is instead hosted by
dotster.
When someone queries for
www.webdomain.com the request will be forwarded to dotster for the lookup (since your
local DNS server isn't authoritative for that zone), while requests for
testing.webdomain.com will be handled by your internal DNS server.
Comments
Post a Comment