We have ACL's, Views, and split the zone into an internal AND external zone already. We are returning internal IP's to the RFC 1918's defined in our internal ACL and view for external carries "any" and has a modified zone that includes the A record for the public entry instead of the private RFC 1918 address. Everything works great, except that the "unmanaged" file keeps getting replaced by the server after a short period.
We seemed to track down that there was a named.conf.unmanaged file being used to overwrite the configuration even when in unmanaged mode. Replacing this file with our splitview named.conf that separates the internal zone from the external zone seems to have resolved the occasional reset of the /etc/named.conf. The logic appears that even when NOT using dns locally as a managed service the server is still replacing the file with a copy of the same zone created when it was a managed service. In theory if the server is not set to point to itself for DNS I would assume that the system would leave the /etc/named.conf file alone, or that a clear definition of "unmanaged service" be made. As the idea behind managing your own local firewall is to move it to unmanaged, I would assume the same would go for unmanaged DNS.
Post by Michael PicherAlan,
Typically you would want to manage your external DNS at a DNS provider.
For instance, a-1networks.com DNS is probably hosted somewhere (godaddy, network solutions, etc).
The real goal here is to make it easy for users to roam outside the network and inside the network. Thus when you setup your SIP domain you usually want to think about what you have available for DNS in the outside world.
_sip._udp.sipdomain SRV 10 10 5060 fqdn.of.server
_sip._tcp.sipdomain SRV 10 10 5060 fqdn.of.server
_xmpp-client._tcp.sipdomain SRV 10 10 5222 fqdn.of.server
_xmpp-server._tcp.sipdomain SRV 10 10 5269 fqdn.or.server
_xmpp-client._tcp.conference.sipdomain SRV 10 10 5222 fqdn.of.server
_xmpp-server._tcp.conference.sipdomain SRV 10 10 5222 fqdn.or.server (yes 5222!)
fqdn.of.server A ip.address.of.server (this is the only record that different inside vs. outside).
You really don't want to open up port 53 for external DNS query... you really just want split DNS. This means that there are two different DNS servers that are authoritative for 'sipdomain'. One internally that returns internal IP's and one externally that returns external IP's.
Hope that make sense.
Mike
On Wed, Oct 24, 2012 at 11:00 PM, Alan Worstell
Post by Alan WorstellHello,
We have a 4.6 server set up, and wanted to have a split view DNS system
so it hands the public IP address out to public queries and the internal
address to anything on the local LAN. I've configured the DNS service to
be unmanaged in the GUI, added a firewall script in
/usr/share/sipxecs/cfinputs/plugin.d/ to allow UDP port 53 through, and
queries work internally and externally.
However, periodically, /etc/named.conf keeps getting overwritten with a
generic conf.
Is there any way to prevent this from being overwritten?
Hi,
checking unmanaged DNS should be the only setting to prevent this,
could you provide sipxagent.log after such rewrite to see what
happens?
George
_______________________________________________
sipx-users mailing list
List Archive: http://list.sipfoundry.org/archive/sipx-users/
--
Michael Picher, Director of Technical Services
eZuce, Inc.
300 Brickstone Square
Suite 201
Andover, MA. 01810
O.978-296-1005 X2015
M.207-956-0262
@mpicher <http://twitter.com/mpicher>
linkedin
www.ezuce.com
------------------------------------------------------------------------------------------------------------
There are 10 kinds of people in the world, those who understand binary and those who don't.
_______________________________________________
sipx-users mailing list
List Archive: http://list.sipfoundry.org/archive/sipx-users/