-1

On my job's intranet we have internal applications that are not available in public for example: app1.example.com, app2.example.com whilst there is the example.com public facing website. Both app1.example.com and app2.example.com are resolving into intranet's ip.

So as far as I searched, I found that this is possible by having a local DNS server into our intranet.

Therefore I wanted to replicate that by using Virtualbox VMs, so used 3 Ubuntu flavored Vm's One Xubuntu, One Lubuntu and one Ubuntu Budgie Edition leftover form previous 'experiments'. All of them are having 2 network Adapters:

  • One setup as NAT and
  • Another one as 'Internal Network' with static having ips from 192.0.0.0/24 network.

On Xubuntu one I installed the bind9 and a webserver and I try to simulate by by typing into Xubuntu and Budgie Edition Vms' browser app1.intranet.example.com and app2.intranet.example.com to serve 2 different sites. These sites won't be available outside the network (of theese 3 Vms) wont even be able to even resolve the DNS entries for theese 2 sites.

As for Now on the vm running the bind (The Xubuntu One) Has these settings:

options {
        directory "/var/cache/bind";


        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

         forwarders {
                208.67.222.222;
                208.67.220.220;
         };

        //========================================================================
        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        //========================================================================
        dnssec-validation auto;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
};

acl "intranet" { 192.0.0.1/24; };
view "intranetView" {
        match-clients { "intranet"; };
        recursion yes;
        zone "intranet.example.com" {
                type master;
                file "/etc/bind/db.intranet"
        }
}

view "outside" {
        match-clients { any; }
        recursion no;
}

Also on /etc/bind/db.intranet I have the following entries:

;
; BIND data file for local loopback interface
;
$TTL    604800
@   IN  SOA intranet.example.com. root.example.com. (
                  2     ; Serial
             604800     ; Refresh
              86400     ; Retry
            2419200     ; Expire
             604800 )   ; Negative Cache TTL
;
@   IN  NS  192.0.0.2
@   IN  A   192.0.0.2
app1    IN  A   192.0.0.2
app2    IN  A   192.0.0.2

But for some reason when I try to restart the bind It fails. Can you help me out to figure out the problem?

Dimitrios Desyllas
  • 523
  • 2
  • 10
  • 27

2 Answers2

1

NS record MUST be hostnames

you're also missing some ; after }

Command:

named-checkconf /etc/named.conf
named-checkzone example.com example.com

Output:

example.com:12: NS record '192.0.0.2' appears to be an address
zone example.com/IN: NS '192.0.0.2.example.com' has no address records (A or AAAA)
zone example.com/IN: not loaded due to errors.
Jacob Evans
  • 7,636
  • 3
  • 25
  • 55
0

Further to Jacob's reply your also missing a listen-on for ip4.

Also check the syslog for any useful clues

And try named-checkconf and named-checkzone. Very useful tools before starting the bind service.

Ian Chilvers
  • 407
  • 2
  • 7
  • 19