We're planning to set it up this way. Going to be switching from our old
cobbled together LDAP / etc solution to FreeIPA "Soon" (tm).
Have tested things. You'll have to make some changes from defaults.
First, for any replica that is going to be serving DNS publicly (in our
case, only a few will, the rest will not be accessible) you'll want to
change them so they're can't be used as recursive resolvers by the entire
Internet. You'll of course also want to limit the firewall so that only DNS
traffic from outside reaches it, ideally. No point being any more exposed
than necessary.
In named.conf you'll want to make the following changes :
< allow-recursion { any; };
---
allow-recursion { internal; };
then somewhere down below (in the 'top' level of configuration, not inside
the same section as allow-recursion) add:
acl "internal" {
10.0.0.0/8;
localhost;
localnets;
};
Assuming 10.0.0.0/8 is your internal IP space. Obviously substitute / add
IP ranges as needed. You can also rename it so it's something other than
'internal', just make sure the allow-recursion line and the acl name match.
This way your own clients can still recursively resolve but the Internet
can't.
Second, to make sure you're handing out public IPs for the name servers
themselves, you'll want to add extra DNS records for them with the public
IPs. i.e. ours FreeIPA servers are nominally
ipa-11.example.com,
ipa-12.example.com, etc, but we added
ns11.example.com,
ns12.example.com etc
correspondingly for the ones that will be externally accessible as A
records to the external IPs that correspond with those servers. You'll then
remove the default FreeIPA NS records (i.e. 'ipa11.example.com') and add
these newly added domains (i.e. 'ns11.example.com') as NS records so that
nobody tries to resolve against inaccessible hosts.
Next, in the DNS Zones > (zone) > Settings page, set the Authoritive
nameserver to one of the externally accessible names (not entirely sure
this matters because the next step ... )
Next, for each externally accessible server, DNS Servers > (server) and
change SOA mname override to your externally accesible name (i.e. '
ns11.example.com.' - I believe it should have the trailing dot, that's how
we're set up and it worked)
I *think* that was all the steps needed. I initially tested this late last
year so I may be missing something from memory and skimming our test
instance's configuration.
On Tue, Jan 22, 2019 at 5:17 AM 74cmonty via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
Hi,
to my knowledge IPA's DNS server is Bind.
And this server is working as recursive DNS for internal domains.
Question:
Can I use this DNS server for recursive DNS request of external domains,
too?
If yes, how?
My intention is to send client request to Pi-hole first for DNS filtering;
Pi-hole will act as DHCP, too.
If IPA's DNS server bind does recurse, then I would have it set as the
upstream to Pi-hole.
Client --> Pi-hole --> IPA --> Internet
In case IPA's DNS server does not support recurse DNS for external
domains, then I consider to add another service proving recurse DNS only:
unbound DNS.
Client --> Pi-hole --> IPA --> Unbound --> Internet
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...