Bind9 Response Policy ignoring out-of-zone data

Question

I'm trying to set up response policy on my existing Bind9 server because I'd like to override some of my company public domain to redirect them to our private network ips.

I've followed this tutorial : https://www.linuxbabe.com/ubuntu/set-up-response-policy-zone-rpz-in-bind-resolver-on-debian-ubuntu

However, I'm getting this error for the two domains I'm trying to override :

named[17104]: /etc/bind/zones/db.rpz:17: ignoring out-of-zone data (xxx.mydomain1.com)
named[17104]: /etc/bind/zones/db.rpz:19: ignoring out-of-zone data (yyy.mydomain2.com)
named[17104]: (re)loading policy zone 'rpz' changed from 0 to 2 qname, 0 to 0 nsdname, 0 to 0 IP, 0 to 0 NSIP, 0 to 0 CLIENTIP entries
named[17104]: zone rpz/IN: loaded serial 14

here's my configuration : named.conf.local :

zone "rpz" {
    type master;
    file "/etc/bind/zones/db.rpz";
    allow-transfer { IP_DNS2; };
};

named.conf.options :

options {
        ...OPTIONS...
        response-policy {
                zone "rpz";
        };
}

/etc/bind/zones/db.rpz :

;
; BIND data file for local loopback interface
;
$TTL    604800
@       IN      SOA     localhost.rpz. root.rpz. (
                              14         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;

@       IN      NS      localhost.rpz.

localhost.rpz.  A       127.0.0.1

xxx.mydomain.com.    A       PRIVATE_IP

yyy.mydomain2.com.      A       PRIVATE_IP

score 0 · Accepted Answer · answered Nov 10 '21 at 09:50

0

I decided to start over and copy db.empty to db.rpz and add the two domains and now it seems to work.

answered Nov 10 '21 at 09:50

Ror

321
3
16

score 0 · Answer 2 · answered Nov 10 '21 at 17:09

0

AFAIR LHS should NOT end in . in RPZ zone file.

answered Nov 10 '21 at 17:09

Tomek

3,390
1
16
10

This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - [From Review](/review/low-quality-posts/502495) – bjoster Nov 11 '21 at 15:49
Yes, it does. The zone is `rpz` and the names DO NOT belong to it. – Tomek Nov 11 '21 at 16:21

Bind9 Response Policy ignoring out-of-zone data

2 Answers2