Ce site est optimisé pour être consulté depuis un navigateur moderne dans lequel JavaScript est activé.

Remplacer certaines entrées DNS dans BIND pour les réseaux internes

ayi

I have an internal network with a DNS server running BIND, connected to the internet through a single gateway. My domain “<a href="http://example.com" rel="noopener nofollow ugc">example.com</a>” is managed by an external DNS provider. Some of the entries in that domain, say “<a href="http://host1.example.com" rel="noopener nofollow ugc">host1.example.com</a>” and “<a href="http://host2.example.com" rel="noopener nofollow ugc">host2.example.com</a>”, as well as the top-level entry “<a href="http://example.com" rel="noopener nofollow ugc">example.com</a>”, point to the public IP address of the gateway.
I would like hosts located on the internal network to resolve “<a href="http://host1.example.com" rel="noopener nofollow ugc">host1.example.com</a>”, “<a href="http://host2.example.com" rel="noopener nofollow ugc">host2.example.com</a>” and “<a href="http://example.com" rel="noopener nofollow ugc">example.com</a>” to internal IP addresses instead of that of the gateway. Other hosts like “<a href="http://otherhost.example.com" rel="noopener nofollow ugc">otherhost.example.com</a>” should still be resolved by the external DNS provider.
I have succeeded in doing that for the host1 and host2 entries, by defining two single-entry zones in BIND for “<a href="http://host1.example.com" rel="noopener nofollow ugc">host1.example.com</a>” and “<a href="http://host2.example.com" rel="noopener nofollow ugc">host2.example.com</a>”. However, if I add a zone for “<a href="http://example.com" rel="noopener nofollow ugc">example.com</a>”, all queries for that domain are resolved by my local DNS server, and e.g. querying “<a href="http://otherhost.example.com" rel="noopener nofollow ugc">otherhost.example.com</a>” results in an error.
Is it possible to configure BIND to override only some entries of a domain, and to resolve the rest recursively?
<hr>
Source : [](<a href="https://www.redpill-linpro.com/sysadvent/2015/12/08/dns-rpz.html" class="inline-onebox" rel="noopener nofollow ugc">Overriding DNS for fun and profit – /techblog</a>](<a href="https://www.redpill-linpro.com/sysadvent/2015/12/08/dns-rpz.html" class="inline-onebox" rel="noopener nofollow ugc">Overriding DNS for fun and profit – /techblog</a>)

ayi_2

The best method is via the response policy zone in Bind 9.8.1 or newer. It allows you to override single records in arbitrary zones (and there’s no need to create a whole subdomain for that, only the single record you want to change), it allows you to override CNAMEs, etc. Other solutions such as Unbound cannot override CNAMEs.
<a href="https://www.redpill-linpro.com/sysadvent/2015/12/08/dns-rpz.html">https://www.redpill-linpro.com/sysadvent/2015/12/08/dns-rpz.html</a>
EDIT: Let’s do this properly then. I will document what I’ve done based on the tutorial linked above.
My OS is Raspbian 4.4 for Raspberry Pi, but the technique should work without any changes on Debian and Ubuntu, or with minimal changes on other platforms.
Go to where your Bind config files are kept on your system - here it’s in <code>/etc/bind</code>. Create in there a file called <code>db.rpz</code> with the following contents:
<pre><code class="lang-auto">$TTL 60
@ IN SOA localhost. root.localhost. (
2015112501 ; serial
1h ; refresh
30m ; retry
1w ; expiry
30m) ; minimum
IN NS localhost.

localhost A 127.0.0.1

www.some-website.com A 127.0.0.1

www.other-website.com CNAME fake-hostname.com.

</code></pre>
What does it do?
<ul>
<li>
it overrides the IP address for <code>www.some-website.com</code> with the fake address <code>127.0.0.1</code>, effectively sending all traffic for that site to the loopback address
</li>
<li>
it sends traffic for <code>www.other-website.com</code> to another site called <code>fake-hostname.com</code>
</li>
</ul>
Anything that could go in a Bind zone file you can use here.
To activate these changes there are a few more steps:
Edit <code>named.conf.local</code> and add this section:
<pre><code class="lang-auto">zone "rpz" {
type master;
file "/etc/bind/db.rpz";
};

</code></pre>
The tutorial linked above tells you to add more stuff to <code>zone "rpz" { }</code> but that’s not necessary in simple setups - what I’ve shown here is the minimum to make it work on your local resolver.
Edit <code>named.conf.options</code> and somewhere in the <code>options { }</code> section add the <code>response-policy</code> option:
<pre><code class="lang-auto">options {
// bunch
// of
// stuff
// please
// ignore

response-policy { zone "rpz"; };
}

</code></pre>
Now restart Bind:
<pre><code class="lang-auto">service bind9 restart

</code></pre>
That’s it. The nameserver should begin overriding those records now.
If you need to make changes, just edit <code>db.rpz</code>, then restart Bind again.
Bonus: if you want to log DNS queries to syslog, so you can keep an eye on the proceedings, edit <code>named.conf.local</code> and make sure there’s a <code>logging</code> section that includes these statements:
<pre><code class="lang-auto">logging {
// stuff
// already
// there

channel my_syslog {
    syslog daemon;
    severity info;
};
category queries { my_syslog; };

};

</code></pre>
Restart Bind again and that’s it.
Test it on the machine running Bind:
<pre><code class="lang-auto">dig @127.0.0.1 www.other-website.com. any

</code></pre>
If you run dig on a different machine just use @the-ip-address-of-Bind-server instead of @127.0.0.1
I’ve used this technique with great success to override the CNAME for a website I was working on, sending it to a new AWS load balancer that I was just testing. A Raspberry Pi was used to run Bind, and the RPi was also configured to function as a WiFi router - so by connecting devices to the SSID running on the RPi I would get the DNS overrides I needed for testing.