We're planning to set it up this way. Going to be switching from our old cobbled together LDAP / etc solution to FreeIPA "Soon" (tm).

Have tested things. You'll have to make some changes from defaults.

First, for any replica that is going to be serving DNS publicly (in our case, only a few will, the rest will not be accessible) you'll want to change them so they're can't be used as recursive resolvers by the entire Internet. You'll of course also want to limit the firewall so that only DNS traffic from outside reaches it, ideally. No point being any more exposed than necessary.

In named.conf you'll want to make the following changes :

< allow-recursion { any; };

---

  allow-recursion { internal; };

then somewhere down below (in the 'top' level of configuration, not inside the same section as allow-recursion) add:

acl "internal" {

10.0.0.0/8;

localhost;

localnets;

};

Assuming 10.0.0.0/8 is your internal IP space. Obviously substitute / add IP ranges as needed. You can also rename it so it's something other than 'internal', just make sure the allow-recursion line and the acl name match. This way your own clients can still recursively resolve but the Internet can't.

Second, to make sure you're handing out public IPs for the name servers themselves, you'll want to add extra DNS records for them with the public IPs. i.e. ours FreeIPA servers are nominally ipa-11.example.com, ipa-12.example.com, etc, but we added ns11.example.com, ns12.example.com etc correspondingly for the ones that will be externally accessible as A records to the external IPs that correspond with those servers. You'll then remove the default FreeIPA NS records (i.e. 'ipa11.example.com') and add these newly added domains (i.e. 'ns11.example.com') as NS records so that nobody tries to resolve against inaccessible hosts.

Next, in the DNS Zones > (zone) > Settings page, set the Authoritive nameserver to one of the externally accessible names (not entirely sure this matters because the next step ... )

Next, for each externally accessible server, DNS Servers > (server) and change SOA mname override to your externally accesible name (i.e. ' ns11.example.com.' - I believe it should have the trailing dot, that's how we're set up and it worked)

I *think* that was all the steps needed. I initially tested this late last year so I may be missing something from memory and skimming our test instance's configuration.

On Tue, Jan 22, 2019 at 5:17 AM 74cmonty via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:

Hi, to my knowledge IPA's DNS server is Bind. And this server is working as recursive DNS for internal domains.

Question: Can I use this DNS server for recursive DNS request of external domains, too? If yes, how?

My intention is to send client request to Pi-hole first for DNS filtering; Pi-hole will act as DHCP, too. If IPA's DNS server bind does recurse, then I would have it set as the upstream to Pi-hole. Client --> Pi-hole --> IPA --> Internet

In case IPA's DNS server does not support recurse DNS for external domains, then I consider to add another service proving recurse DNS only: unbound DNS. Client --> Pi-hole --> IPA --> Unbound --> Internet _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...