From owner-freebsd-net@FreeBSD.ORG Sat Apr 19 15:40:02 2003 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7800837B401 for ; Sat, 19 Apr 2003 15:40:02 -0700 (PDT) Received: from mail.parodius.com (mail.parodius.com [64.71.184.173]) by mx1.FreeBSD.org (Postfix) with ESMTP id D987D43F75 for ; Sat, 19 Apr 2003 15:40:01 -0700 (PDT) (envelope-from jdc@pentarou.parodius.com) Received: from pentarou.parodius.com (jdc@localhost [127.0.0.1]) by mail.parodius.com (8.12.9/8.12.9) with ESMTP id h3JMdDjU051090 for ; Sat, 19 Apr 2003 15:39:13 -0700 (PDT) (envelope-from jdc@pentarou.parodius.com) Received: (from jdc@localhost) by pentarou.parodius.com (8.12.9/8.12.9/Submit) id h3JMdD8S051089 for freebsd-net@freebsd.org; Sat, 19 Apr 2003 15:39:13 -0700 (PDT) Date: Sat, 19 Apr 2003 15:39:13 -0700 From: Jeremy Chadwick To: freebsd-net@freebsd.org Message-ID: <20030419223913.GA51072@parodius.com> References: <20030419064801.GA11635@parodius.com> <1050791079.007237.719.nullmailer@cicuta.babolo.ru> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1050791079.007237.719.nullmailer@cicuta.babolo.ru> User-Agent: Mutt/1.5.4i Subject: Re: BIND-8/9 interface bug? Or is it FreeBSD? X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 19 Apr 2003 22:40:02 -0000 I hadn't considered jails -- I can't believe I forgot about them. An excellent idea. For now, I've moved both of my nameservers over to relying entirely on the public IP network for transmission of everything, and as expected, it works great. I might have to try the jail method for the private network! Thanks. :-) -- | Jeremy Chadwick jdc@parodius.com | | Parodius Networking http://www.parodius.com/ | | UNIX Systems Administrator Mountain View, CA, USA | | Making life hard for others since 1977. | On Sun, Apr 20, 2003 at 02:24:38AM +0400, "."@babolo.ru wrote: > > The secondary is configured literally identical to the > > primary, except that the IPs have changed and _all_ of > > the zones are type slave. > > > > I see the exact same problem on the secondary (again, > > outgoing traffic on the public interface with an IP of > > the private), except that the src & dst IPs apply to > > the private IP on the secondary and the WAN IP of the > > primary, respectively. Sorry if that's confusing. :-) > > > > Thank you for your below example -- I didn't consider that > > BIND would do something that ""silly"" (note quotes), but > > now it makes sense. > > > > I believe removing the query-source option could in fact > > solve the problem, but there is a specific reason for it's > > existance -- we rely on the MAPS RBL+ service for SBL lookups, > > which are DNS based. Permission to the RBL+ service is based > > on the IP doing the query. Since the nameserver IPs are > > IP aliases, if I do not specify this, the queries come from > > the first IP in the list shown in ifconfig -a. > > > > If there's a workaround for this, I'd love to hear it. :-) > I use different named in different jails for > public and private zones. > Each pair on one host. > Jail garantee that only dedicated IP will be used. > > possible transfers are: > > host1 host2 > > priv named <---> priv named > ^ ^ > | | > V V > pub named <----> pub named > > public named knows nothing about private zones > private named is used by clients and > forwards queryes to his public partner > on the same host for non-private zones > and have all private zones as master or slave > > PS > http://free.babolo.ru/ports/jailup/ > to easy establish jailed services > > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"