<div dir="ltr"><span style="color:rgb(33,33,33)">quoting:</span><div><span style="color:rgb(33,33,33)">> version "Shirley, you're joking";</span></div><div><br></div><div>shouldn't it be "Shirley, you can't be serious"</div><div>("I am serious, and don't call me Shirley").</div><div><br></div><div><br class="gmail_msg"><br><div class="gmail_quote"><div dir="ltr">On Mon, Apr 3, 2017 at 12:16 PM Rick Moen <<a href="mailto:rick@linuxmafia.com">rick@linuxmafia.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Quoting Ehud Kaldor (<a href="mailto:ehud.kaldor@gmail.com" class="gmail_msg" target="_blank">ehud.kaldor@gmail.com</a>):<br class="gmail_msg">
<br class="gmail_msg">
> so, what you're saying is that if i have Bind9 running as a local DNS, i<br class="gmail_msg">
> can just remove the 'forward' section and be done with it?<br class="gmail_msg">
<br class="gmail_msg">
I think so. Comment it out for caution's sake, though. ;-> (You want<br class="gmail_msg">
to be able to revert your change quickly if need be. In fact, I<br class="gmail_msg">
recommend keeping all of /etc in verion control. Joey Hess's etckeeper<br class="gmail_msg">
is good for that.)<br class="gmail_msg">
<br class="gmail_msg">
Quoting<br class="gmail_msg">
<a href="https://www.digitalocean.com/community/tutorials/how-to-configure-bind-as-a-caching-or-forwarding-dns-server-on-ubuntu-14-04" rel="noreferrer" class="gmail_msg" target="_blank">https://www.digitalocean.com/community/tutorials/how-to-configure-bind-as-a-caching-or-forwarding-dns-server-on-ubuntu-14-04</a><br class="gmail_msg">
:<br class="gmail_msg">
<br class="gmail_msg">
A forwarding DNS server offers the same advantage of maintaining a<br class="gmail_msg">
cache to improve DNS resolution times for clients. However, it actually<br class="gmail_msg">
does none of the recursive querying itself. Instead, it forwards all<br class="gmail_msg">
requests to an outside resolving server and then caches the results to<br class="gmail_msg">
use for later queries.<br class="gmail_msg">
<br class="gmail_msg">
This lets the forwarding server respond from its cache, while not<br class="gmail_msg">
requiring it to do all of the work of recursive queries. This allows the<br class="gmail_msg">
server to only make single requests (the forwarded client request)<br class="gmail_msg">
instead of having to go through the entire recursion routine. This may<br class="gmail_msg">
be an advantage in environments where external bandwidth transfer is<br class="gmail_msg">
costly, where your caching servers might need to be changed often, or<br class="gmail_msg">
when you wish to forward local queries to one server and external<br class="gmail_msg">
queries to another server.<br class="gmail_msg">
<br class="gmail_msg">
This bit:<br class="gmail_msg">
<br class="gmail_msg">
options {<br class="gmail_msg">
directory "/var/cache/bind";<br class="gmail_msg">
<br class="gmail_msg">
recursion yes;<br class="gmail_msg">
allow-query { goodclients; };<br class="gmail_msg">
<br class="gmail_msg">
forwarders {<br class="gmail_msg">
8.8.8.8;<br class="gmail_msg">
8.8.4.4;<br class="gmail_msg">
};<br class="gmail_msg">
<br class="gmail_msg">
You would turn into:<br class="gmail_msg">
<br class="gmail_msg">
<br class="gmail_msg">
options {<br class="gmail_msg">
directory "/var/cache/bind";<br class="gmail_msg">
<br class="gmail_msg">
recursion yes;<br class="gmail_msg">
allow-query { goodclients; };<br class="gmail_msg">
<br class="gmail_msg">
// forwarders {<br class="gmail_msg">
// 8.8.8.8;<br class="gmail_msg">
// 8.8.4.4;<br class="gmail_msg">
};<br class="gmail_msg">
<br class="gmail_msg">
<br class="gmail_msg">
That's taken from the <a href="http://digitalocean.com" rel="noreferrer" class="gmail_msg" target="_blank">digitalocean.com</a> page. Here's the example from my<br class="gmail_msg">
very own aging instance of BIND9 on Debian:<br class="gmail_msg">
<br class="gmail_msg">
/etc/bind $ less named.conf.options<br class="gmail_msg">
options {<br class="gmail_msg">
directory "/var/cache/bind";<br class="gmail_msg">
<br class="gmail_msg">
// If there is a firewall between you and nameservers you want<br class="gmail_msg">
// to talk to, you might need to uncomment the query-source<br class="gmail_msg">
// directive below. Previous versions of BIND always asked<br class="gmail_msg">
// questions using port 53, but BIND 8.1 and later use an<br class="gmail_msg">
// unprivileged<br class="gmail_msg">
// port by default.<br class="gmail_msg">
<br class="gmail_msg">
// query-source address * port 53;<br class="gmail_msg">
<br class="gmail_msg">
version "Shirley, you're joking";<br class="gmail_msg">
hostname "<a href="http://ns1.linuxmafia.com" rel="noreferrer" class="gmail_msg" target="_blank">ns1.linuxmafia.com</a>";<br class="gmail_msg">
//server-id is essentially redundant to hostname, default is<br class="gmail_msg">
//none<br class="gmail_msg">
//server-id none;<br class="gmail_msg">
<br class="gmail_msg">
// If your ISP provided one or more IP addresses for stable<br class="gmail_msg">
// nameservers, you probably want to use them as forwarders.<br class="gmail_msg">
// Uncomment the following block, and insert the addresses<br class="gmail_msg">
// replacing<br class="gmail_msg">
// the all-0's placeholder.<br class="gmail_msg">
//forwarders {<br class="gmail_msg">
// 198.144.192.4;<br class="gmail_msg">
// // 209.81.9.1;<br class="gmail_msg">
// // 165.90.49.12;<br class="gmail_msg">
//};<br class="gmail_msg">
<br class="gmail_msg">
auth-nxdomain no; # conform to RFC1035<br class="gmail_msg">
<br class="gmail_msg">
allow-recursion {<br class="gmail_msg">
<a href="http://127.0.0.0/8" rel="noreferrer" class="gmail_msg" target="_blank">127.0.0.0/8</a>;<br class="gmail_msg">
<a href="http://192.168.0.0/24" rel="noreferrer" class="gmail_msg" target="_blank">192.168.0.0/24</a>;<br class="gmail_msg">
<a href="http://10.0.0.0/8" rel="noreferrer" class="gmail_msg" target="_blank">10.0.0.0/8</a>;<br class="gmail_msg">
<a href="http://198.144.195.186/29" rel="noreferrer" class="gmail_msg" target="_blank">198.144.195.186/29</a>;<br class="gmail_msg">
};<br class="gmail_msg">
allow-query {<br class="gmail_msg">
<a href="http://127.0.0.0/8" rel="noreferrer" class="gmail_msg" target="_blank">127.0.0.0/8</a>;<br class="gmail_msg">
<a href="http://192.168.0.0/24" rel="noreferrer" class="gmail_msg" target="_blank">192.168.0.0/24</a>;<br class="gmail_msg">
<a href="http://10.0.0.0/8" rel="noreferrer" class="gmail_msg" target="_blank">10.0.0.0/8</a>;<br class="gmail_msg">
<a href="http://198.144.195.186/29" rel="noreferrer" class="gmail_msg" target="_blank">198.144.195.186/29</a>;<br class="gmail_msg">
};<br class="gmail_msg">
dnssec-validation yes;<br class="gmail_msg">
};<br class="gmail_msg">
<br class="gmail_msg">
<br class="gmail_msg">
BTW, it's past time to migrate to better alternatives to BIND9,<br class="gmail_msg">
_especially_ if you are only doing recursive nameservice (and no<br class="gmail_msg">
serving up of authoritative DNS to the public for your or others'<br class="gmail_msg">
domains). The problem with BIND9 is that it's a kitchen sink<br class="gmail_msg">
(and also slow, large, and has a sketchy security history).<br class="gmail_msg">
<br class="gmail_msg">
I feel sheepish about still running BIND9 in 2017, but I _do_ provide<br class="gmail_msg">
both recursive and authoritative DNS and thus need to handle both types,<br class="gmail_msg">
and also migrating to better things is part of my larger 'Get off<br class="gmail_msg">
antique stuff without breaking production services' problem.<br class="gmail_msg">
<br class="gmail_msg">
My own preference for a better recursive-only package is Unbound, and my<br class="gmail_msg">
preference for an authorative-only package is NSD. To run both (as each<br class="gmail_msg">
wants to bind to port 53), I'll need to rearchitect just a little.<br class="gmail_msg">
<br class="gmail_msg">
But anyway, for recursive-only deployments, I'd urge giving BIND9 a pass<br class="gmail_msg">
and deploying Unbound instead.<br class="gmail_msg">
<br class="gmail_msg">
<br class="gmail_msg">
_______________________________________________<br class="gmail_msg">
conspire mailing list<br class="gmail_msg">
<a href="mailto:conspire@linuxmafia.com" class="gmail_msg" target="_blank">conspire@linuxmafia.com</a><br class="gmail_msg">
<a href="http://linuxmafia.com/mailman/listinfo/conspire" rel="noreferrer" class="gmail_msg" target="_blank">http://linuxmafia.com/mailman/listinfo/conspire</a><br class="gmail_msg">
</blockquote></div></div></div>