I have a server doing NAT from a LAN to a WAN. The WAN is not under
our control.
en1 is the primary interface, connected to the WAN with IP
10.101.137.11
en0 is the secondary interface, with IP 192.168.1.11, serving DHCP
to the clients, propagating itself as the router with IP 192.168.1.11.
We do not answer DNS request from the WAN.
This server is an OpenDirectory Master and AFP file server.
What *I think* I want to see from a client is:
$ dig xschr01.chr.psreg.lan
;; ANSWER SECTION:
xschr01.chr.psreg.lan. 86400 IN A 192.168.1.11
;; AUTHORITY SECTION:
chr.psreg.lan. 86400 IN NS xschr01.chr.psreg.lan.
And on the server
;; ANSWER SECTION:
xschr01.chr.psreg.lan. 86400 IN A 192.168.1.11
the two answers above look equivalent.
I'm not sure if this is correct, please advise.
If it is, I would now add the following to my named.conf:
options {
directory "/var/named";
};
view "localhost" {
match-clients { localhost; };
recursion yes; /* this is the default */
zone "chr.psreg.lan" {
type master;
file "local/db.chr.psreg.lan";
allow-transfer { any; };
};
};
view "internal" {
match-clients { localnets; };
recursion yes; /* this is the default */
zone "chr.psreg.lan" {
type master;
file "internal/db.chr.psreg.lan";
allow-transfer { any; };
};
};
why two views when the data served, so far, is the same?
zone "chr.psreg.lan" {
type master;
file "external/db.chr.psreg.lan";
allow-transfer { none; };
};
};
nobody would ever ask you for a .lan top domain address (or have
things changed that I did not notice...?), so why this view at all?
But the main doubt is: what NAT problems are you trying to solve,
since you mentioned them in the subject?
Following this I need 3 files:
/private/var/named/internal/db.chr.psreg.lan"; containing
192.168.1.11 as the servers A record and all the client info
/private/var/named/external/db.chr.psreg.lan"; containing
10.101.137.11 as the servers A record and no other info
/private/var/named/local/db.chr.psreg.lan"; containing 10.101.137.11
as the servers A record and all the client info
ah, above you mistyped the answer you want on the localhost view! They
are different in the end. Still don't see what the external is for.
Anyway, if you want things to work, I think you need to setup the
reverse to, so that primary IP -> hostname -> primary IP.
This should make "changeip -checkhostname" happy.
Just one advice, if you can take more addresses in the external
interface do so. This way you can distinguish natted from not natted
traffic. Not passing through NAT traffic meant for the router is a
good thing. I used to have recurrent ssh problems because of this (on
certain hardware).
Giuliano
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Macos-x-server mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/macos-x-server/email@hidden
