From owner-freebsd-questions@FreeBSD.ORG  Fri Oct 21 13:05:23 2005
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 7C4BE16A41F
	for <freebsd-questions@freebsd.org>;
	Fri, 21 Oct 2005 13:05:23 +0000 (GMT)
	(envelope-from kilim@phenix.rootshell.be)
Received: from phenix.rootshell.be (phenix.rootshell.be [217.22.55.50])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 0B48F43D49
	for <freebsd-questions@freebsd.org>;
	Fri, 21 Oct 2005 13:05:22 +0000 (GMT)
	(envelope-from kilim@phenix.rootshell.be)
Received: by phenix.rootshell.be (Postfix, from userid 58045)
	id BB0EA1797D; Fri, 21 Oct 2005 15:04:41 +0200 (CEST)
Date: Fri, 21 Oct 2005 15:04:41 +0200
From: kilim <kilim@phenix.rootshell.be>
To: freebsd-questions@freebsd.org
Message-ID: <20051021130441.GA14018@phenix.rootshell.be>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.4.1i
Subject: DNS server on firewall
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 21 Oct 2005 13:05:23 -0000

Hi,

I'm getting a second machine next week and was wondering if the
following settup would be ok:

1st machine pf + NAT and also primary DNS
2nd machine as a secondary DNS

Now I know that its not the smartest thing to do, have primary DNS on
the firewall, but I'm thinking since the DNS is going to be chrooted,
it would be ok, no ?

What do you think ?

Thank you !