Date: Sat, 6 Sep 2008 22:52:29 -0700 From: George Davidovich <freebsd@optimis.net> To: freebsd-questions@freebsd.org Subject: Re: mail server DNS configuration questions Message-ID: <20080907055229.GA93793@marvin.optimis.net> In-Reply-To: <200809061928.28539.af300wsm@gmail.com> References: <200809061928.28539.af300wsm@gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Sep 06, 2008 at 07:28:28PM -0600, Andrew Falanga wrote: > > Well, my clients at church are still having issues and after working with > George, a respondant to my original questions, I think that most, if not all, > of my problems are related to DNS and how we've got it improperly configured. > > First, a crude drawing of how our mail server exists in the world: > > 192.168.2.x/24 72.24.23.252 "lot's of networks" > Private Network <--> CableOne <--> Internet > > Now, our mail server's IP is 192.168.2.23. On the router, he (the person at > whose house the mail server is) has IP forwarding setup so that mail get's > sent to our FreeBSD machine. Using dig, here's the responses: > > (from my FBSD machine at home, not the server) > [/usr/home/andy] -> dig +short -t MX whitneybaptist.org > 10 mail.whitneybaptist.org. > [/usr/home/andy] -> dig +short -t A whitneybaptist.org > 72.24.34.252 > [/usr/home/andy] -> dig +short -x 72.24.34.252 > 34-252.72-24-cpe.cableone.net. > > (from the church FBSD machine) > [/home/afalanga] -> hostname > whitbap > [/home/afalanga] -> ifconfig fxp0 > fxp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 > options=8<VLAN_MTU> > inet 192.168.2.23 netmask 0xffffff00 broadcast 255.255.255.255 > ether 00:d0:b7:74:87:48 > media: Ethernet autoselect (100baseTX <full-duplex>) > status: active > [/home/afalanga] -> cat /etc/resolv.conf > search McCutchanLAN > nameserver 192.168.2.1 > > It doesn't take a rocket scientist, or a computer scientist, to figure out > we've got DNS issues. I'm thinking that I should setup a domain within the > 192.168.2.0/24 network on this box. I've done this before, at work. The > question I've got is I've never actually integrated a domain like this to a > domain on the Internet. I'm thinking that we'll setup something like: > internal.whitneybaptist.org with hosts in that sub-domain. > > So, what would my DNS tables need to look like to make this happen. Also, to > any knowledgable souls here, what RFCs address these issues? Hello again, Andy. What you're asking is actually a FAQ, but I'll spell things out anyway. The following excerpt from RFC 1918 is most relevant: If an enterprise uses the private address space, or a mix of private and public address spaces, then DNS clients outside of the enterprise should not see addresses in the private address space used by the enterprise, since these addresses would be ambiguous. One way to ensure this is to run two authority servers for each DNS zone containing both publically and privately addressed hosts. One server would be visible from the public address space and would contain only the subset of the enterprise's addresses which were reachable using public addresses. The other server would be reachable only from the private network and would contain the full set of data, including the private addresses and whatever public addresses are reachable the private network. In order to ensure consistency, both servers should be configured from the same data of which the publically visible zone only contains a filtered version. There is certain degree of additional complexity associated with providing these capabilities. That's a roundabout way of saying you can't "mix and match" private non-routable addresses with public addresses in the same namespace. Note the "authoritative" part. Until CableOne delegates your assigned netblock to your organisation, your public DNS server will not be authoritative (it currently isn't!) for 72.24.34.252. You can reference RFC 2317 (classless in-addr.arpa delegation) for how that works. As to why you must be authoritative, I've already pointed out off-list how Bad Things can happen when you're not, especially in regards to email where reverse lookups are integral to How Things Work. As for other RFCs, I'd suggest instead starting with a careful reading of the Bind ARM at http://www.isc.org/sw/bind/, followed by a once-over of the Bind FAQ, and possibly the FreeBSD-supplied configuration files. To save you some time, the following abbreviated context-specific examples should explain things more clearly and get you started: Example 1: Two domains and two separate (sets of) name servers: On the ns.whitneybaptist.org machine: zone "whitneybaptist.org" { type master; file "master/whitneybaptist.org"; }; zone "252.34.24.72.in-addr.arpa" { type master; file "master/db.72.24.34.252"; }; On the ns.internal.whitneybaptist.org machine: zone "internal.whitneybaptist.org" { type master; file "master/internal.whitneybaptist.org"; }; zone "1.168.192.in-addr.arpa" { type master; file "master/db.192.168.1"; }; # slave whitneybaptist.org zones here The contents of /etc/resolv.conf for internal hosts: domain internal.whitneybaptist.org nameserver 192.168.1.X Example 2: One domain and a single (set of) name server(s) employing Bind's "view" feature: acl "lan_hosts" { 192.168.1/24; 192.168.2/24; }; key "external" { algorithm hmac-md5; secret "XXXXXXX=="; }; view "internal" { match-clients { !key external; lan_hosts; }; allow-recursion { lan_hosts; }; zone "whitneybaptist.org" { type master; file "master/whitneybaptist.org.internal"; }; zone "1.168.192.in-addr.arpa" { type master; file "master/db.192.168.1"; }; view "external" { match-clients { key external; any; }; recursion no; zone "whitneybaptist.org" { type master; file "master/whitneybaptist.org.external"; }; zone "252.34.24.72.in-addr.arpa" { type master; file "master/db.72.24.34.252"; }; The contents of /etc/resolv.conf for internal hosts: domain whitneybaptist.org nameserver 72.24.34.252 # Note: if 'nameserver' is NAT-ed, you'd use its # internal address instead You'll have to decide for yourself which approach works best for you. - If you opt for 2 domains, you'll need to reconfigure all your internal hosts, and then add more machines to serve up DNS for those hosts. - If you opt for one domain and use Bind's view feature, you can leave your internal hosts alone (assuming they're already part of the whitneybaptist.org domain) and skip the requirement for additional machines, but your DNS configuration will be a little more complex. -- George
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080907055229.GA93793>