Hi,<br><br>I'd really appreciate some help on this. I thought this was working when testing,<br>but today when rolling it into production it fails me.<br><br>I have internal and external views in named.conf<br><br>The goal is to allow everyone (in and out) to query my domain,<br>
but allow only internal users to query the outside world.<br><br>We had this working before in Redhat 5, but something has changed and<br>it isn't working for RH 6.<br><br>The strange thing is, I can do queries of the outside OK from<br>
the DNS server, or from systems on the same subnet.<br><br>The ones I want to let use the view, seem to match the view,<br>but are blocked:<br><br>Dec 20 10:14:58 sedna named[7574]: 20-Dec-2012 10:14:58.759 security: info: client XXX.YYY.200.66#55286: view internal: query (cache) '<a href="http://onmail.com/MX/IN">onmail.com/MX/IN</a>' denied<br>
<br>acl "local_lan" {<br> XXX.YYY.0.0/16;<br> 127.0.0.1;<br>};<br><br>view "internal"<br>{<br>/* This view will contain zones you want to serve only to "internal" clients<br> that connect via your directly attached LAN interfaces - "localnets" .<br>
*/<br> match-clients { local_lan; XXX.YYY.1.3; };<br> match-destinations { any; };<br> recursion yes;<br> additional-from-auth yes;<br> additional-from-cache yes;<br> empty-zones-enable yes;<br>
notify yes;<br> allow-transfer { adcs; XXX.YYYY.1.3; };<br> also-notify { XXX.YYY.200.67; XXX.YYY.200.66; XXX.YYY.1.3;};<br> // all views must contain the root hints zone:<br> include "/etc/named.root.hints";<br>
<br> include "/etc/named.rfc1912.zones";<br><br> zone "<a href="http://mydomain.ca">mydomain.ca</a>" in {<br> type master;<br> file "forward/<a href="http://mydomain.ca">mydomain.ca</a>";<br>
};<br><br> zone "XXX.YYY.in-addr.arpa" in {<br> type master;<br> file "reverse/db.XXX.YYY.rev";<br> };<br><br><br>};<br><br><br>I've changed the first digits of my network IPs to XXX.YYY.<br>
<br>The DNS system is on XXX.YYY.2.48, and systems on subnet 2 can query it OK.<br>Other systems which should fall in the /16 network are not able to query.<br><br>It seems like there is something about Bind 9.8 I'm missing.<br>
Running BIND 9.8.2rc1-RedHat-9.8.2-0.10.rc1.el6_3.5 <br><br><br>