Raspberry Pi Secondary DNS Server

Domain Information

Domain       : chorke.org
Subdomain    : bgd.chorke.org (public)
CNAME of dev : cki00.ddns.net (noip.com)

Netowrk Information

GTW : 10.19.83.1    (Gateway/Router)
DMZ : 10.19.83.100    (bgd.chorke.org  & Name server)
LAN : 10.19.83.0/24 (Private network & range 0~255)

Install

sudo su
apt update && apt upgrade
apt install bind9 bind9utils bind9-doc dnsutils
#apt purge  bind9 bind9utils bind9-doc dnsutils
#sudo apt autoremove

nano /etc/default/bind9

# run resolvconf?
RESOLVCONF=no

# startup options for the server
OPTIONS="-u bind -4"

Primary Options

nano /etc/bind/named.conf.options

acl internals {
    127.0.0.0/24;  # 0-255
    10.19.83.0/24; # 0-255
};

acl externals {
    10.19.83.0/29;  # 0-7
    !10.19.83.0/24; # 0-255
};

options {
    directory "/var/cache/bind";
    auth-nxdomain no;
    // If there is a firewall between you and nameservers you want
    // to talk to, you may need to fix the firewall to allow multiple
    // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

    listen-on port 53 {
        127.0.0.1;
        10.19.83.100;
    };

    // If your ISP provided one or more IP addresses for stable 
    // nameservers, you probably want to use them as forwarders.  
    // Uncomment the following block, and insert the addresses replacing 
    // the all-0's placeholder.

    forwarders {
        8.8.8.8;    # Google DNS
        8.8.4.4;    # Google DNS
    };

    //========================================================================
    // If BIND logs error messages about the root key being expired,
    // you will need to update your keys.  See https://www.isc.org/bind-keys
    //========================================================================
    dnssec-validation auto;

    recursion yes;
    listen-on-v6 { none; };
    allow-transfer { none; };
    allow-query { internals; };
    allow-recursion { internals; };
};

Primary Zones

nano /etc/bind/named.conf.local

include "/etc/bind/rndc.key";
zone "bgd.chorke.org" {
    type master;
    file "/etc/bind/zones/db.bgd.chorke.org";     # zone file path
    allow-update { key rndc-key; };
    allow-transfer {
        10.19.83.101;
        10.19.83.102;
    };
};

zone "83.19.10.in-addr.arpa" {
    type master;
    file "/etc/bind/zones/db.83.19.10";           # 10.19.83.0/24 subnet
    allow-update { key rndc-key; };
    allow-transfer {
        10.19.83.101;                
        10.19.83.102;             
    };
};

// consider adding the 1918 zones here
// include "/etc/bind/zones.rfc1918";

Forward Zone

mkdir /etc/bind/zones
cp /etc/bind/db.local /etc/bind/zones/db.bgd.chorke.org
nano /etc/bind/zones/db.bgd.chorke.org

;
; BIND forward data file
;
$TTL     600    ;  10M
$ORIGIN bgd.chorke.org.

@       IN      SOA     dns0.bgd.chorke.org. root.bgd.chorke.org. (
                        202012050           ; Serial       YYYYmmddI
                             3600           ; Refresh            01H
                              600           ; Retry              10M
                            86400           ; Expire             01D
                              600 )         ; Negative Cache TTL 10M
; NS Records Name Servers
@       IN      NS      dns0.bgd.chorke.org.
@       IN      NS      dns1.bgd.chorke.org.
@       IN      NS      dns2.bgd.chorke.org.
@       IN      A       10.19.83.100

; A  Records Name Servers
dns0            A       10.19.83.100
dns1            A       10.19.83.101
dns2            A       10.19.83.102

; A  Records 10.19.83.0/24
apn0            A       10.19.83.2
db00            A       10.19.83.105
db01            A       10.19.83.208
db02            A       10.19.83.109
dmz0            A       10.19.83.100
ftp0            A       10.19.83.204
git0            A       10.19.83.206
gtw0            A       10.19.83.1
iis0            A       10.19.83.207
mac0            A       10.19.83.110
mcu0            A       10.19.83.99
mob0            A       10.19.83.4
mob1            A       10.19.83.5
mob2            A       10.19.83.6
nas0            A       10.19.83.204
ns00            A       10.19.83.100
ns01            A       10.19.83.101
ns02            A       10.19.83.102
ns03            A       10.19.83.203
ns04            A       10.19.83.204
ns05            A       10.19.83.105
ns06            A       10.19.83.206
ns07            A       10.19.83.207
ns08            A       10.19.83.208
ns09            A       10.19.83.109
ns10            A       10.19.83.110
pc00            A       10.19.83.207
pc01            A       10.19.83.208
pc02            A       10.19.83.109
pc03            A       10.19.83.110
pi00            A       10.19.83.100
pi01            A       10.19.83.101
pi02            A       10.19.83.102
pi03            A       10.19.83.203
pi04            A       10.19.83.204
pi05            A       10.19.83.105
pi06            A       10.19.83.206
tab0            A       10.19.83.7
tv00            A       10.19.83.3
vpn0            A       10.19.83.203
www0            A       10.19.83.100
; CNAME
www             CNAME   www0

Reverse Zone

cp /etc/bind/db.127 /etc/bind/zones/db.83.19.10
nano /etc/bind/zones/db.83.19.10

;
; BIND reverse data file
;

$TTL 600 ; 10M
$ORIGIN 83.19.10.in-addr.arpa.

@       IN      SOA     dns0.bgd.chorke.org. root.bgd.chorke.org. (
                        202012050           ; Serial       YYYYmmddI
                             3600           ; Refresh            01H
                              600           ; Retry              10M
                            86400           ; Expire             01D
                              600 )         ; Negative Cache TTL 10M
; NS  Records
@       IN      NS      dns0.bgd.chorke.org.
@       IN      NS      dns1.bgd.chorke.org.
@       IN      NS      dns2.bgd.chorke.org.
; PTR Records
1       IN      PTR     gtw0.bgd.chorke.org.
2       IN      PTR     apn0.bgd.chorke.org.
3       IN      PTR     tv00.bgd.chorke.org.
4       IN      PTR     mob0.bgd.chorke.org.
5       IN      PTR     mob1.bgd.chorke.org.
6       IN      PTR     mob2.bgd.chorke.org.
7       IN      PTR     tab0.bgd.chorke.org.
99      IN      PTR     mcu0.bgd.chorke.org.
100     IN      PTR     dmz0.bgd.chorke.org.
100     IN      PTR     dns0.bgd.chorke.org.
100     IN      PTR     ns00.bgd.chorke.org.
100     IN      PTR     pi00.bgd.chorke.org.
100     IN      PTR     www.bgd.chorke.org.
100     IN      PTR     www0.bgd.chorke.org.
101     IN      PTR     dns1.bgd.chorke.org.
101     IN      PTR     ns01.bgd.chorke.org.
101     IN      PTR     pi01.bgd.chorke.org.
102     IN      PTR     dns2.bgd.chorke.org.
102     IN      PTR     ns02.bgd.chorke.org.
102     IN      PTR     pi02.bgd.chorke.org.
105     IN      PTR     ns05.bgd.chorke.org.
105     IN      PTR     pi05.bgd.chorke.org.
105     IN      PTR     rdb0.bgd.chorke.org.
109     IN      PTR     db02.bgd.chorke.org.
109     IN      PTR     ns09.bgd.chorke.org.
109     IN      PTR     pc02.bgd.chorke.org.
110     IN      PTR     mac0.bgd.chorke.org.
110     IN      PTR     ns10.bgd.chorke.org.
110     IN      PTR     pc03.bgd.chorke.org.
203     IN      PTR     ns03.bgd.chorke.org.
203     IN      PTR     pi03.bgd.chorke.org.
203     IN      PTR     vpn0.bgd.chorke.org.
204     IN      PTR     ftp0.bgd.chorke.org.
204     IN      PTR     nas0.bgd.chorke.org.
204     IN      PTR     ns04.bgd.chorke.org.
204     IN      PTR     pi04.bgd.chorke.org.
206     IN      PTR     git0.bgd.chorke.org.
206     IN      PTR     ns06.bgd.chorke.org.
206     IN      PTR     pi06.bgd.chorke.org.
207     IN      PTR     iis0.bgd.chorke.org.
207     IN      PTR     ns07.bgd.chorke.org.
207     IN      PTR     pc00.bgd.chorke.org.
208     IN      PTR     ns08.bgd.chorke.org.
208     IN      PTR     pc01.bgd.chorke.org.
208     IN      PTR     rdb1.bgd.chorke.org.

Secondary Options

nano /etc/bind/named.conf.options

acl internals {
    127.0.0.0/24;  # 0-255
    10.19.83.0/24; # 0-255
};

acl externals {
    10.19.83.0/29;  # 0-7
    !10.19.83.0/24; # 0-255
};

options {
    directory "/var/cache/bind";
    auth-nxdomain no;
    // If there is a firewall between you and nameservers you want
    // to talk to, you may need to fix the firewall to allow multiple
    // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

    listen-on port 53 {
        127.0.0.1;
        10.19.83.101;
    };

    // If your ISP provided one or more IP addresses for stable
    // nameservers, you probably want to use them as forwarders.
    // Uncomment the following block, and insert the addresses replacing
    // the all-0's placeholder.

    forwarders {
        8.8.8.8;    # Google DNS
        8.8.4.4;    # Google DNS
    };

    //========================================================================
    // If BIND logs error messages about the root key being expired,
    // you will need to update your keys.  See https://www.isc.org/bind-keys
    //========================================================================
    dnssec-validation auto;

    recursion yes;
    listen-on-v6 { none; };
    allow-transfer { none; };
    allow-query { internals; };
    allow-recursion { internals; };
};

Secondary Zones

nano /etc/bind/named.conf.local

include "/etc/bind/rndc.key";
zone "bgd.chorke.org" {
    type slave;
    file "db.bgd.chorke.org";     # zone file path
    masters { 10.19.83.100; };
};

zone "83.19.10.in-addr.arpa" {
    type slave;
    file "db.83.19.10";           # 10.19.83.0/24 subnet
    masters { 10.19.83.100; };
};

// consider adding the 1918 zones here
// include "/etc/bind/zones.rfc1918";

Server

named-checkconf -z
named-checkzone bgd.chorke.org /etc/bind/zones/db.bgd.chorke.org
named-checkzone 83.19.10.in-addr.arpa /etc/bind/zones/db.83.19.10

update-rc.d bind9 enable
/etc/init.d/bind9 restart
service bind9 restart
netstat -tulpn
netstat -tap
reboot

rndc dumpdb -cache
rndc flush
rndc reload

Client

sudo nano /etc/dhcpcd.conf

# Chorke Academia, Inc.
#static domain_name_servers=10.19.83.100 10.19.83.1
static domain_search=bgd.chorke.org
#static host_name=pih

sudo systemctl restart dhcpcd
sudo systemctl daemon-reload

sudo apt install resolvconf
sudo apt install openresolv
sudo resolvconf -u

Debug

@rem clear windows dns cache
ipconfig /flushdns
ipconfig /displaydns

scutil --dns
scutil -r hostname
# clear macos dns cache
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist
sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist

# clear ubuntu dns cache
sudo systemd-resolve --flush-caches
sudo systemd-resolve --statistics
#sudo /etc/init.d/dns-clean start

#from local area network
dig @10.19.83.100 chorke.org
dig @10.19.83.100 bgd.chorke.org
dig @10.19.83.100 apn.bgd.chorke.org
dig @10.19.83.100 gtw.bgd.chorke.org

#from horizon/world wide 
dig @bgd.chorke.org chorke.org
dig @bgd.chorke.org -x 10.19.83.1
dig @bgd.chorke.org bgd.chorke.org
dig @bgd.chorke.org apn.bgd.chorke.org
dig @bgd.chorke.org gtw.bgd.chorke.org

#from lan only
nslookup chorke.org
nslookup bgd.chorke.org
nslookup apn.bgd.chorke.org
nslookup gtw.bgd.chorke.org

References

• How To Configure Bind as an Authoritative-Only DNS Server on Ubuntu 14.04
• How To Configure BIND as a Private Network DNS Server on Ubuntu 16.04
• How To Configure BIND as a Private Network DNS Server on Ubuntu 18.04
• Set Up Authoritative DNS Server on Ubuntu 18.04, 16.04 with BIND9
• Raspberry Pi Bind9 DNS/DDNS (Dynamic DNS) Server
• Stealth (DMZ/Hidden Master) Name Server
• Configuring a DNS Server in Raspberry Pi
• Setting up Private DNS Server with BIND9
• DNS Sample External Domain Zone file
• BIND Definition of Address List Match
• DNS not resolving on Mac OS X
• Stealth (Split/DMZ) DNS Server
• List of Statements