2

Let's see if anyone could help me. In my scenario, I have a DNS service from a vendor which must receive all queries and check a white list to resolve a domain or not. In order to answer queries, the source IP address must be only one trusted IP address, which is from a public DNS server that I have in my DMZ. So, I've configured BIND as "forward only". All the customers query my public DNS server and it is forwarding to the vendor DNS service.

Problem: There are some pages which contain content from different sources or feeds from other websites and different domains. When I query from my local station directly to the vendor DNS service, those domains that are allowed get answered and I have partial webpage loaded (content from not allowed domains aren't answered and the webpage doesn't load properly). That's an expected behavior. When I query through my public DNS server which should just forward the queries, I doesn't have any part of the page loaded. It seems that, after a first deny, the page stop loading, or my public DNS server isn't forwarding all the queries to the vendor DNS service.

Have you all got any similar problem? Should it be a linux/OS problem, a security configuration of BIND or should I set any other parameter to forward all the queries?

Here is my named.conf.options file:

options {
directory "/var/cache/bind";
recursion yes;
allow-query { any; };
forward only;
forwarders{ X.X.X.X; Y.Y.Y.Y; };
allow-recursion { any; };
allow-query-cache {any; };
clients-per-query 0;
recursive-clients 0;
auth-nxdomain no;    # conform to RFC1035
listen-on-v6 { any; };
};

Thank you in advance!

1 Answer 1

0

Solved! Couldn'd find a way of doing this with BIND, shifted to PowerDNS, configured recursor to be the vendor DNS service and no cache enabled, now it's working as I needed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .