I have a DNS server (BIND 9.10.3-P4-Ubuntu) on an Ubuntu 16.04 machine. I have a domain with two A records (IP1,IP2) which indicates to two separate web servers (Wserver1, Wserver2). I want the DNS server responds to the queries of country A from IP1 and the others from IP2. I have created a file named GeoIP.acl and included it in bind configurations and also added my A records to the related files of bind service.
named.conf:
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.default-zones";
include "/etc/bind/GeoIP-AA.acl";
named.conf.options:
options {
recursion no;
// Put files that named is allowed to write in the data/ directory:
directory "/var/cache/bind";
dnssec-validation auto;
auth-nxdomain no; # conform to RFC1035
allow-query { any; };
};
logging {
channel default_log {
file "/var/log/named/named.log" versions 5 size 128M;
print-time yes;
print-severity yes;
print-category yes;
severity warning;
};
channel query_log {
file "/var/log/named/query.log";
severity debug 3;
print-severity yes;
print-time yes;
};
category queries { query_log; };
category default { default_log; };
category general { default_log; };
};
named.conf.default-zones
view "Country A" {
match-clients { AA; };
recursion no;
additional-from-cache no;
zone "test.com" IN {
type master;
file "/var/cache/bind/test-AA.com.db";
allow-update { none; };
allow-query { any; };
notify yes;
};
view "Other" {
match-clients { any; };
recursion no;
additional-from-cache no;
zone "test.com" IN {
type master;
file "/var/cache/bind/test.com.db";
allow-update { none; };
allow-query { any; };
notify yes;
};
GeoIP-AA.acl:
acl "AA" {
x1.x2.0.0/16;
y1.y2.0.0/22;
z1.z2.0.0/22;
w1.w2.0.0/8;
};
test-AA.com.db has IP1 as A record and test.com.db has IP2 as A record. With these configurations I hope all clients from country A receives IP1 and other clients receives IP2 as the site IP address. It seems everything is working OK except that I saw some IP addresses in the logs which are redirected from wrong clients! I mean when I check the webserver logs of Wserver2 I can see some IPs which are in the GeoIP-AA.acl IP address ranges and received IP2 as the web site IP address. The file GeoIP-AA.acl has 6000 records. I wonder to know is there any limitations on using GeoIP ACLs with bind9? I think all IP address ranges are not checked in Bind or something else happens such as limitations in number of ACL records. Any help is appreciated