<div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif"><span style="font-family:arial">On Tue, Sep 10, 2013 at 5:54 PM, Petr Spacek </span><span dir="ltr" style="font-family:arial"><<a href="mailto:pspacek@redhat.com" target="_blank">pspacek@redhat.com</a>></span><span style="font-family:arial"> wrote:</span><br>
</div><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="">
<div class="h5">On 10.9.2013 05:28, Andrew Lau wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><div class="h5">
On Mon, Sep 9, 2013 at 9:30 PM, Andrew Lau <<a href="mailto:andrew@andrewklau.com" target="_blank">andrew@andrewklau.com</a>> wrote:<br>
<br>
</div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><div class="h5">
On Mon, Sep 9, 2013 at 8:26 PM, Petr Spacek <<a href="mailto:pspacek@redhat.com" target="_blank">pspacek@redhat.com</a>> wrote:<br>
<br>
</div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><div class="h5">
On 8.9.2013 05:54, Andrew Lau wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
Hi all,<br>
<br>
I wasn't able to find much, but is it possible to configure FreeIPA to<br>
serve as a split horizon DNS server?<br>
<br>
I would like the local network to be able to enroll and authenticate<br>
locally, but at the same time bridge remote clients as well.<br>
<br>
Suggestions?<br>
<br>
</blockquote>
<br>
Could you give us more details? We can try to find some solution for you<br>
particular situation.<br>
<br>
In general, FreeIPA doesn't support so-called views from BIND9 directly,<br>
but you can use e.g. FreeIPA integrated DNS for internal network (the<br>
internal view) and expose flat zone file for external view.<br>
<br>
Example configuration (/etc/named.conf):<br>
view "internal"<br>
{<br>
/* This view will contain zones you want to serve only to "internal"<br>
clients<br>
that connect via your directly attached LAN interfaces - "localnets" .<br>
*/<br>
match-clients { localnets; };<br>
recursion yes;<br>
<br>
dynamic-db "ipa" {<br>
library "ldap.so";<br></div></div>
arg "uri ldapi://%2fvar%2frun%2fslapd-*<u></u>*IPA-TEST.socket";<div><div class="h5"><br>
arg "base cn=dns, dc=ipa,dc=test";<br>
};<br>
};<br>
<br>
view "external"<br>
{<br>
/* This view will contain zones you want to serve only to "external"<br>
clients<br>
* that have addresses that are not match any above view:<br>
*/<br>
match-clients { any; };<br>
recursion no;<br>
<br>
zone "my.external.zone" {<br>
type master;<br>
file "my.external.zone.db";<br>
};<br>
};<br>
<br>
Have a nice day.<br>
</div></div></blockquote><div><div class="h5">
<br>
<br>
Hi Petr,<br>
<br>
Thanks - I ended up running a slave DNS server with bind9 views. It's just<br>
a bit of a pain having to now manage two DNS configs but it'll have to do.<br>
<br>
Thanks,<br>
Andrew.<br>
<br>
<br>
</div></div></blockquote><div><div class="h5">
I spoke too soon..<br>
<br>
My scenario I have is internal clients enrolled into FreeIPA, all the IPs<br>
registered on <a href="http://internal.domain.com" target="_blank">internal.domain.com</a> are internal IPs. I want to use the<br>
FreeIPA server to also serve the DNS for <a href="http://domain.com" target="_blank">domain.com</a> but because it's hidden<br>
in a private network I had setup slave DNS servers but they don't seem to<br>
use the authoritative nameserver setting,<br>
<br>
So eg.<br>
<a href="http://ipa01.internal.domain.com" target="_blank">ipa01.internal.domain.com</a> (private IP Address) --> <a href="http://dns01.domain.com" target="_blank">dns01.domain.com</a> (public<br>
IP adddress)<br>
<br>
The records that get served to <a href="http://dns01.domain.com" target="_blank">dns01.domain.com</a> are:<br>
<br>
<a href="http://domain.com" target="_blank">domain.com</a> IN SOA <a href="http://ipa02.internal.domain.com" target="_blank">ipa02.internal.domain.com</a>. <a href="http://hostmaster.domain.com" target="_blank">hostmaster.domain.com</a>.<br>
(<br>
<br>
Any suggestions?<br>
</div></div></blockquote>
<br>
It is most probably caused by 'fake_mname' setting in /etc/named.conf. Named will respect the value in SOA record if you comment this value out, but will lose the ability to load balance DNS dynamic updates between FreeIPA replicas.<br>
<br>
The point is that clients use this name to find the server responsible for zone updates (and nothing else). In FreeIPA's case, any server can update the zone so all servers report itself as zone 'masters'. This allows to spread the load among all replicas and there is no single point of failure.<br>
<br>
The question is - do you need it for external zone? Do you use dynamic update for <a href="http://domain.com" target="_blank">domain.com</a>? I would ignore the internal hostname in the zone if you don't use DNS updates (if you are okay with such information leak).<br>
<br>
Side note:<br>
Don't forget that internal host names normally leak in e-mail headers; from mis-configured clients in internal network; via roaming clients trying to access internal resources while they are not on VPN; etc. etc.<span class=""><font color="#888888"><br>
<br>
-- <br>
Petr^2 Spacek<br>
</font></span></blockquote></div><br></div><div class="gmail_extra"><div class="gmail_default" style="font-family:tahoma,sans-serif">I would like to keep the dynamic updates for <a href="http://domain.com">domain.com</a> so users can modify DNS zones without requiring direct access. My concern was, from what people have been telling me is that the SOA mname resolution is important, on the other hand many have said it's not. What I've been reading has been leaning towards the later.</div>
<div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif">The internal hostnames aren't really hiding anything, it's only because they resolve to internal IPs</div>
<br></div></div>