<div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif"><span style="font-family:arial">On Mon, Sep 9, 2013 at 9:30 PM, Andrew Lau </span><span dir="ltr" style="font-family:arial"><<a href="mailto:andrew@andrewklau.com" target="_blank">andrew@andrewklau.com</a>></span><span style="font-family:arial"> wrote:</span><br>
</div><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">
<div><div class="h5"><div style="font-family:tahoma,sans-serif"><span style="font-family:arial">On Mon, Sep 9, 2013 at 8:26 PM, Petr Spacek </span><span dir="ltr" style="font-family:arial"><<a href="mailto:pspacek@redhat.com" target="_blank">pspacek@redhat.com</a>></span><span style="font-family:arial"> wrote:</span><br>
</div></div></div><div class="gmail_extra"><div class="gmail_quote"><div><div class="h5"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div><div>On 8.9.2013 05:54, Andrew Lau wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
Hi all,<br>
<br>
I wasn't able to find much, but is it possible to configure FreeIPA to<br>
serve as a split horizon DNS server?<br>
<br>
I would like the local network to be able to enroll and authenticate<br>
locally, but at the same time bridge remote clients as well.<br>
<br>
Suggestions?<br>
</blockquote>
<br></div></div>
Could you give us more details? We can try to find some solution for you particular situation.<br>
<br>
In general, FreeIPA doesn't support so-called views from BIND9 directly, but you can use e.g. FreeIPA integrated DNS for internal network (the internal view) and expose flat zone file for external view.<br>
<br>
Example configuration (/etc/named.conf):<br>
view "internal"<br>
{<br>
/* This view will contain zones you want to serve only to "internal" clients<br>
that connect via your directly attached LAN interfaces - "localnets" .<br>
*/<br>
match-clients { localnets; };<br>
recursion yes;<br>
<br>
dynamic-db "ipa" {<br>
library "ldap.so";<br>
arg "uri ldapi://%2fvar%2frun%2fslapd-<u></u>IPA-TEST.socket";<br>
arg "base cn=dns, dc=ipa,dc=test";<br>
};<br>
};<br>
<br>
view "external"<br>
{<br>
/* This view will contain zones you want to serve only to "external" clients<br>
* that have addresses that are not match any above view:<br>
*/<br>
match-clients { any; };<br>
recursion no;<br>
<br>
zone "my.external.zone" {<br>
type master;<br>
file "my.external.zone.db";<br>
};<br>
};<br>
<br>
Have a nice day.</blockquote><div><br></div></div></div><div style="font-family:tahoma,sans-serif">Hi Petr,</div><div style="font-family:tahoma,sans-serif"><br></div><div style="font-family:tahoma,sans-serif">
Thanks - I ended up running a slave DNS server with bind9 views. It's just a bit of a pain having to now manage two DNS configs but it'll have to do.</div><div style="font-family:tahoma,sans-serif">
<br></div><div style="font-family:tahoma,sans-serif">Thanks,</div><div style="font-family:tahoma,sans-serif">Andrew.</div><div><br></div></div></div></div></blockquote><div class="gmail_default" style="font-family:tahoma,sans-serif">
<br></div><div class="gmail_default" style="font-family:tahoma,sans-serif">I spoke too soon.. </div><div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif">
My scenario I have is internal clients enrolled into FreeIPA, all the IPs registered on <a href="http://internal.domain.com">internal.domain.com</a> are internal IPs. I want to use the FreeIPA server to also serve the DNS for <a href="http://domain.com">domain.com</a> but because it's hidden in a private network I had setup slave DNS servers but they don't seem to use the authoritative nameserver setting,</div>
<div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif">So eg.</div><div class="gmail_default" style="font-family:tahoma,sans-serif"><a href="http://ipa01.internal.domain.com">ipa01.internal.domain.com</a> (private IP Address) --> <a href="http://dns01.domain.com">dns01.domain.com</a> (public IP adddress)</div>
<div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif">The records that get served to <a href="http://dns01.domain.com">dns01.domain.com</a> are:</div>
<div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default"><div class="gmail_default"><font face="tahoma, sans-serif"><a href="http://domain.com">domain.com</a> IN SOA <a href="http://ipa02.internal.domain.com">ipa02.internal.domain.com</a>. <a href="http://hostmaster.domain.com">hostmaster.domain.com</a>. (</font></div>
<div style="font-family:tahoma,sans-serif"><br></div></div></div><div class="gmail_default" style="font-family:tahoma,sans-serif">Any suggestions?</div><br></div></div>