I'm having trouble configuring BIND to do exactly what I want, and
lately I'm despairing of it even being possible.
My LAN has a firewall (LRP) that controls the dial-up line and acts as
the gateway router for the other hosts. A separate host provides DNS to
[ The Net ]---/ /---[ Firewall/Gateway ]
[ DNS Server ]-------------+-----[ Other hosts ]
What I want is for all the hosts on the LAN to use the local primary DNS
server 192.168.1.5 (I will be adding a secondary soon) for all DNS
queries. This means the local DNS server must also give responses for
global DNS queries.
The point it falls apart, of course, is that the connection to the
internet is intermittent, and there is no simple way for the DNS server
to know the link status without trying a connection. I've seen
solutions suggested for dialup lines, but they all assume BIND is
running on the same host that controls the PPP link, which is not the
case here, and I don't want it to be because that would complicate the
firewall (bad security).
When I use 192.168.1.5 as the sole nameserver, its BIND must be
restarted every time the link status changes to clear its cache
otherwise it will continue to return "host unknown" if that result is
cached. When I use other nameservers provided by my ISP, name
resolution takes interminably long when the link is down because the
hosts are waiting for DNS request timeouts to hosts that are not
contactable, and takes a long time even for local hosts because the
ISP's name servers know nothing about my local hosts.
I've tried messing with the forwarding options for BIND, but they still
seem dependent on the permanent availability of the uplink DNS servers.
My ideal solution would be to configure the 192.168.1.5 BIND so that it
can be used as the sole nameserver entry for my LAN hosts, and will
immediately respond with "host unknown" for hosts outside my LAN when
the link is down instead of waiting for several timeouts.
If ICMP can tell me the network is unreachable, why can't a DNS query
figure it out? Is that because it's UDP? Can I somehow get BIND to use
ICMP to check the availability of an upline DNS server before sending
its UDP packet?
Is what I'm trying to achieve even possible? From reading the DNS-HOWTO
and O'Reilly "DNS and BIND", I can't tell; they have pathetically little
coverage of the specific issues faced on an intermittent link.