Subject: fwtk and DNS

From: wen <[email-masked]>
Date: Mon, 24 Jul 2000 16:38:42 +0800

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

   hi:

is it sure that both fwtk and DNS server must be installed  a  host? if the answer is yes and I wish to setup DNS server behind the box intalled fwtk,what shoud I do?

wen

---

From: Joseph S D Yao <[email-masked]>
Date: Mon, 31 Jul 2000 18:16:58 -0400

> is it sure that both fwtk and DNS server must be installed  a  host? if the answer is yes and I wish to setup DNS server behind the box intalled fwtk,what shoud I do?

When setting up BIND, be sure to use the latest version.  Right now,
that is 8.2.2-P5, but "soon" it will be 8.2.3 [use it] or 9.0.0 [wait
until this settles down].

If you want to resolve DNS from the Internet - and you almost certainly
do - you must have a DNS server running as your proxy on your firewall
bastion host.  If that is all it is, ISTM it will not need to have any
zones defined.

The bastion host's resolver, however, should be your internal name
server.

The internal name server should be authoritative for all zones inside
the firewall, both forward and reverse.  If the internal domain is the
same as the external domain, then the internal zones must duplicate all
of the information in the external zones.

The internal name server must forward all queries that it cannot
resolve to the firewall bastion host.

In the special case where your internal name server is also the bastion
host, you must set it to accept queries only from the inside, and not
from the outside.  It will not have to forward external queries: it can
make them itself.  This is not the best configuration.

In the special case where your bastion host name server is your
external name server, it should have ONLY external addresses in it.  As
I said before, if your external domain and your internal domain are the
same, then you must duplicate information in the two servers' zones.

It is possible to have the firewall bastion host be both internal and
external name server.  This is by far NOT the best configuration.  You
would have to run TWO instances of 'named'.  You would have to make
sure that they run from two different configuration files, that they
use two different sockets to communicate with 'ndc', and that they
logged to different files [preferably].

Many people these days are using for their name servers machines that
are not used for any other purpose.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.