0

I'm setting up an internal website for a small company. I also set up a private DNS server inside the office network that resolves the hostname of said internal website. I then changed the router's DHCP settings, setting a public DNS server as the primary DNS, and setting my private DNS server as the secondary. However, I did something wrong and it's causing network instability inside the company. Here's what I did:

  1. The company network's gateway adderss/router's address is 192.168.0.1.
  2. I set up an internal website on a server with a fixed IP address of 192.168.0.10.
  3. On the same server, I set up a BIND DNS server. I want it to resolve the hostname "mywebsite.local" to 192.168.0.10, and forward all other queries to the public DNS servers. The BIND server's configuration file looks like the following
zone "." {
    type forward;
    forward only;
    forwarders{
        192.168.0.1;
    };
};

zone "local" {
        type master;
        file "/var/lib/bind/local.hosts";
        };

zone "localhost" {
        type master;
        file "/etc/bind/db.local";
};

zone "127.in-addr.arpa" {
        type master;
        file "/etc/bind/db.127";
};

zone "0.in-addr.arpa" {
        type master;
        file "/etc/bind/db.0";
};

zone "255.in-addr.arpa" {
        type master;
        file "/etc/bind/db.255";
};
  1. /var/lib/bind/local.hosts looks like the following
local.  IN      SOA     ns.local. foo.bar.com. (
                        1602646014
                        10800
                        3600
                        604800
                        38400 )
local.  IN      NS      ns.local.
ns.local.       IN      A       192.168.0.10
mywebsite.local.      IN      A       192.168.0.10
  1. I changed the DHCP settings on the router, giving 8.8.8.8 as primary DNS server, and giving 192.168.0.10 as secondary DNS server.
  2. After the above settings are done, my clients experienced network outrage.

What did I do wrong?

1 Answer 1

1

I changed the DHCP settings on the router, giving 8.8.8.8 as primary DNS server, and giving 192.168.0.10 as secondary DNS server.

This is not correct. If you specify multiple DNS servers, they are all expected to provide the same content – if Google's 8.8.8.8 responds that "mywebsite.local" is unknown, the client will take that as the final answer and will not try the other server.

Clients will only switch to another server if the original server does not respond at all.

So you should list only your custom server – and if you want reliability in case it goes down, then you should set up two local servers (one of them replicating the local zones from another).

After the above settings are done, my clients experienced network outrage.

For network outage, make sure the global options section in named.conf specifies your entire LAN subnet under allow-recursion.

allow-recursion { 127.0.0.1; ::1; 192.168.0.0/24; }

To avoid outrage you should test configuration before imposing it on everyone else – that is, manually verify that your server answers DNS queries the way you want. Use the nslookup tool from another Windows PC, or dig / host from a Linux or macOS computer – they let you query a specified server without having to change DHCP settings:

nslookup mywebsite.local 192.168.0.10
nslookup google.com 192.168.0.10
host google.com 192.168.0.10

The second possible problem is that by changing your DHCP settings you might also have told the router itself to use your DNS server, thus creating a loop: your named forwards a query to the router, which then forwards it to your server, which then forwards it to the router, which then forwards it to your server...

To avoid this, specify e.g. 8.8.8.8 as the forward destination in your named.conf, instead of specifying the router's address.

(Not all routers link both settings that way, but some do.)

Other notes

I would recommend against using .local for DNS, since it could conflict with mDNS. Consider something like .lan instead. (But IMO, a better choice for a company network would be to use a subdomain of the company's Internet domain, e.g. .lan.example.org or .corp.example.com.)

I would also suggest defining the zone class in named.conf (zone "local." IN {...}) and the common suffix using the $ORIGIN macro in the zonefile, so that you wouldn't have to repeat them for every record:

$ORIGIN local.
$TTL 1h

@               SOA     ns admin.mycompany.com. ( 1602646014 3h 1h 7d 1h )
                NS      ns

ns              A       192.168.0.10
mywebsite       A       192.168.0.10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.