Re: Disable recursion externally, allow internally

3 msg	Set maximumopen files to -1: permission denied
2 msg	Fixing the order in which multiple records of t...
4 msg	seeking comments on setting up local copy of ro...
4 msg	Bind Front End Util
2 msg	named (bind 9.3.2) continually spawning
2 msg	DDNS
6 msg	bind machine performance for around 500 domains
3 msg	Beehive CoNoNS DNS Survey
2 msg	Timeout on DNS Request with Bind
3 msg	How do You Specify Which Zone to Update in Views?
1 msg	Returning one address from a RRset
2 msg	bind resolver, a/aaaa queries and searchlist be...
5 msg	Limit data transfer zone
4 msg	Split authority for class-B?
1 msg	v9.3.2/freebsd: compile error
4 msg	Logging channel: FILE NOT FOUND

Disable recursion externally, allow internally
\ milney_boy (27 Apr 2006)
. \ Robert Zilbauer (27 Apr 2006)
. \ Kevin Darcy (27 Apr 2006)
. \ Barry Margolin (27 Apr 2006)

4 msg	Debugging IXFR's; getting a partial IXFR
4 msg	named fails answering
2 msg	Name resolution problem for bio.wss.bcentral.com

Subject:	Re: Disable recursion externally, allow internally
Group:	Bind-users
From:	Barry Margolin
Date:	27 Apr 2006

In article <e2qo3s$12hc$1>,
"milney_boy" <milneyboy> wrote:

> Hello,
>
> I'm trying to set up a BIND (version 9.2 i think) server to host DNS
> for my domains. I have set up a RHEL server with a public IP address
> and am now confguring BIND.
>
> As background info, my resolv.conf file has one "nameserver
> xxx.xxx.xxx.xxx" line, where xxx.xxx.xxx.xxx is the public IP address
> that I have given the server (I am not using NAT for this).
>
> I want to set up BIND to allow recursive queries when I do internal
> nslookups, but to not when a query comes from anywhere else.

You don't need views, you just need to use allow-query.

In the main options section, put "allow-query { internalhosts; };".
Then in each public zone that you host, put "allow-query { any; };".

--
Barry Margolin, barmar
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***