Re: Drop forwarded requests

3 msg	named-checkzone ignoring flags?

Drop forwarded requests
\ gagadget (1 Dec 2007)
. \ Barry Margolin (1 Dec 2007)
. . \ Danny Mayer (2 Dec 2007)
. \ Kevin Darcy (3 Dec 2007)

2 msg	Quota error message
5 msg	BIND 9.4.2 on Solaris 8
2 msg	Assertion failure: what to do next?
2 msg	Blackhole option statement in BIND
1 msg	X per-query
3 msg	Restricting what a DNS server returns to a client
4 msg	dig server problem
3 msg	How to forward specific zones?
3 msg	facebook.com delegation
6 msg	Recursive Domain Query on Restricted Recursive DNS
3 msg	Vista machines DOSing our bind servers
4 msg	Root for private network
1 msg	Restricting what a DNS server returns
9 msg	How to define views that differ only minimally?
5 msg	Query Denied bind 9.4
7 msg	Emails being wrongly delivered after DNS change
3 msg	master notification issue
1 msg	BIND 9.4.1-P1 Crashes with rbt.c ...

Subject:	Re: Drop forwarded requests
Group:	Bind-users
From:	Kevin Darcy
Date:	3 Dec 2007

gagadget wrote:
> Hi listers,
>
> Is there a way to prevent BIND to answer frowarded requests ?
>
> For local uses, somebody has setup a DNS on our network ( very large network ),
> his server is forwarding all requests it can't answer. We asked him several
> times to shut down his server but he won't. For security reasons, we don't do
> forwarding on our servers so we would like to deny his forwarded requests
> without deny all his requests.
>
It's not clear what requests you want to block. What requests are you
getting from him that *aren't* forwarded requests? If you just want to
block recursive requests generally, you can use "allow-recursion" and/or
"allow-query-cache", as Barry suggested. Another option to look into
would be to set up an "empty" view solely for recursive clients -- that
would have the advantage of terminating the lookups, as opposed to a
REFUSED response which might result in the client just trying a
different resolver.

Or, as Danny Mayer pointed out, why are you trying to use a technical
band-aid on what is essentially an administrative problem? Your first
line of attack should be to get them to fix the bad behavior, although
I'm sympathetic to the fact that in a large corporation sometimes it's
difficult to get the right people on board for that kind of action...

- Kevin