Split views in DNS
Friday, August 26th, 2005By running a DNS query against the outside interface of my firewall (65.40.217.234), I can see that my DNS configuration is not correct. Specifically, named thinks queries originating at the firewall (192.168.1.1) are for the internal view and returns a worthless address:
[root@triumph etc]# dig @65.40.217.234 www.hapgoods.com
…
;; ANSWER SECTION:
259200Â IN
CNAMEÂ Â ducati.hapgoods.com.
ducati.hapgoods.com.
259200Â IN
AÂ Â Â Â Â Â Â Â Â Â Â 192.168.1.20
…
(BTW, here is a useful command to determine the IP address from which the rest of the world sees you originating:
[root@ducati named]# curl -s http://checkip.dyndns.org/ | grep -i address
)
So, this raises some interesting questions. First, from which address would a true external query appear to originate? Does the named determination of the origin address examine the IP header? To gain some further insight, I looked into the debug output from named as follows:
[root@ducati log]# touch /var/named/chroot/var/named/named.run
[root@ducati log]# chown named:named /var/named/chroot/var/named/named.run
[root@ducati log]# rndc querylog
[root@ducati log]# rndc trace
[root@ducati log]# rndc trace
[root@ducati log]# tail -f /var/named/chroot/var/named/named.run
This allowed me to clearly see that named considered 192.168.1.1 as belonging to the private view -despite having explicitly configured this address in the public view:
Screen clipping taken: 26/08/2005, 16:43
I couldn’t find anything pertinent on the Internet. Then it occurred to me that perhaps the sequence of statements was more important than the explicitness of the entries in /etc/named.conf. Background: some configuration files automatically increase the priority of a configuration statement as the explicitness of the IP address increases. So host addresses are automatically more important than network addresses. But this is not the case with named. So I simply switched the order of the public and private views in the configuration file and suddenly my “external” queries began getting the data from the public view.