S
Steven Lokie
Guest
We have a 2 master setup that was built poorly, so we want to downgrade the second master to a slave configuration, I try and run the conversion and it works well enough internal addresses, but when it tries to hit the external world it says the network is unreachable and fails to give a DNS response. Any help?
I've attached the named.conf
I've attached the named.conf
Code:
//
// See the BIND Administrator's Reference Manual (ARM) for details, in:
// file:///usr/share/doc/bind-*/arm/Bv9ARM.html
// Also see the BIND Configuration GUI : /usr/bin/system-config-bind and
// its manual.
//
options
{
// Those options should be used carefully because they disable port
// randomization
// query-source port 53;
// query-source-v6 port 53;
// Put files that named is allowed to write in the data/ directory:
directory "/var/named"; // the default
dump-file "data/cache_dump.db";
statistics-file "data/named_stats.txt";
memstatistics-file "data/named_mem_stats.txt";
forwarders {
8.8.8.8;
8.8.4.4;
};
};
logging
{
/* If you want to enable debugging, eg. using the 'rndc trace' command,
* named will try to write the 'named.run' file in the $directory (/var/named).
* By default, SELinux policy does not allow named to modify the /var/named directory,
* so put the default debug log file in data/ :
*/
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
//
// All BIND 9 zones are in a "view", which allow different zones to be served
// to different types of client addresses, and for options to be set for groups
// of zones.
//
// By default, if named.conf contains no "view" clauses, all zones are in the
// "default" view, which matches all clients.
//
// If named.conf contains any "view" clause, then all zones MUST be in a view;
// so it is recommended to start off using views to avoid having to restructure
// your configuration files in the future.
//
view "localhost_resolver" {
/* This view sets up named to be a localhost resolver ( caching only nameserver ).
* If all you want is a caching-only nameserver, then you need only define this view:
*/
match-clients { localhost; };
match-destinations { localhost; };
recursion no;
# all views must contain the root hints zone:
include "/etc/named.root.hints";
/* these are zones that contain definitions for all the localhost
* names and addresses, as recommended in RFC1912 - these names should
* ONLY be served to localhost clients:
*/
include "/etc/named.rfc1912.zones";
zone "company.corp" {
type slave;
file "slaves/company.corp.zone";
allow-transfer { 10.69.0.10; };
masters { 10.69.0.10; };
forwarders {};
};
zone "company.dev" {
type slave;
file "slaves/company.dev.zone";
allow-transfer { 10.69.0.10; };
masters { 10.69.0.10; };
forwarders {};
};
zone "69.10.in-addr.arpa" {
type slave;
file "slaves/company.corp.rr.zone";
allow-transfer { 10.69.0.10; };
masters { 10.69.0.10; };
forwarders {};
};
zone "70.10.in-addr.arpa" {
type slave;
file "slaves/company.corp.rr.70.zone";
allow-transfer { 10.69.0.10; };
masters { 10.69.0.10; };
forwarders {};
};
};
view "internal" {
/* This view will contain zones you want to serve only to "internal" clients
* that connect via your directly attached LAN interfaces - "localnets" .
*/
match-clients { any; };
match-destinations { any; };
recursion no;
// all views must contain the root hints zone:
include "/etc/named.root.hints";
// include "named.rfc1912.zones";
// you should not serve your rfc1912 names to non-localhost clients.
// These are your "authoritative" internal zones, and would probably
// also be included in the "localhost_resolver" view above :
zone "company.corp" {
type slave;
file "slaves/company.corp.zone";
allow-transfer { 10.69.0.10; };
masters { 10.69.0.10; };
forwarders {};
};
zone "company.dev" {
type slave;
file "slaves/company.dev.zone";
allow-transfer { 10.69.0.10; };
masters { 10.69.0.10; };
forwarders {};
};
zone "69.10.in-addr.arpa" {
type slave;
file "slaves/company.corp.rr.zone";
allow-transfer { 10.69.0.10; };
masters { 10.69.0.10; };
forwarders {};
};
zone "70.10.in-addr.arpa" {
type slave;
file "slaves/company.corp.rr.70.zone";
allow-transfer { 10.69.0.10; };
masters { 10.69.0.10; };
forwarders {};
};
//zone "my.internal.zone" {
// type master;
// file "my.internal.zone.db";
//};
//zone "my.slave.internal.zone" {
// type slave;
// file "slaves/my.slave.internal.zone.db";
// masters { /* put master nameserver IPs here */ 127.0.0.1; };
// // put slave zones in the slaves/ directory so named can update them
//};
//zone "my.ddns.internal.zone" {
// type master;
// allow-update { key ddns_key; };
// file "slaves/my.ddns.internal.zone.db";
// // put dynamically updateable zones in the slaves/ directory so named can update them
//};
};
key ddns_key {
algorithm hmac-md5;
secret "g1UJONV52cj5x1HOW9EJ2zg0lL2FMA3nwJ2WCENZRCWjAaawcpWAurkRVyDb";
};
//view "external"
//{
///* This view will contain zones you want to serve only to "external" clients
// * that have addresses that are not on your directly attached LAN interface subnets:
// */
// match-clients { any; };
// match-destinations { any; };
//
// recursion no;
// // you'd probably want to deny recursion to external clients, so you don't
// // end up providing free DNS service to all takers
//
// allow-query-cache { none; };
// // Disable lookups for any cached data and root hints
//
// // all views must contain the root hints zone:
// include "/etc/named.root.hints";
//
// // These are your "authoritative" external zones, and would probably
// // contain entries for just your web and mail servers:
//
// zone "my.external.zone" {
// type master;
// file "my.external.zone.db";
// };
//};
