1
[root@workshop1 /]# ifconfig
eth0      Link encap:Ethernet  HWaddr 08:00:27:AF:A3:28  
          inet addr:10.0.2.15  Bcast:10.0.2.255  Mask:255.255.255.0
          inet6 addr: fe80::a00:27ff:feaf:a328/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:35311 errors:0 dropped:0 overruns:0 frame:0
          TX packets:20174 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:50544153 (48.2 MiB)  TX bytes:1108333 (1.0 MiB)

eth1      Link encap:Ethernet  HWaddr 08:00:27:C4:A8:B6  
          inet addr:192.168.56.101  Bcast:192.168.56.255  Mask:255.255.255.0
          inet6 addr: fe80::a00:27ff:fec4:a8b6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3634 errors:0 dropped:0 overruns:0 frame:0
          TX packets:213 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:498977 (487.2 KiB)  TX bytes:32394 (31.6 KiB)

eth2      Link encap:Ethernet  HWaddr 08:00:27:DB:B6:AB  
          inet addr:10.0.4.16  Bcast:10.0.4.255  Mask:255.255.255.0
          inet6 addr: fe80::a00:27ff:fedb:b6ab/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:28 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 b)  TX bytes:4147 (4.0 KiB)

In my /etc/named.conf I want to configure an ACL to disallow the 10.0.4.0/24 network access to my BIND nameserver.

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/3/html/Reference_Guide/s1-bind-namedconf.html

How can I verify that hosts from 10.0.4.0/24 cannot access the nameserver using network tools? Because I will still leave Google's nameserver in /etc/named.conf, so I am assuming if they can't use the BIND nameserver, they will use 8.8.8.8 for name resolution..

1

Assuming that 10.0.2.15 is your DNS, from any of the servers in 10.0.4.0/24 network, use the following command to verify this:

dig www.google.com @10.0.2.15

This command will try to resolve google.com (or any hostnames you want to try) using the nameserver 10.0.2.15. If the server inside the 10.0.4.0/24 network is unable to resolve the hostname with this command, it means they are blocked from using this particular nameserver.

P.S: In the output of the dig, the ANSWER SECTION section will be empty or the ANSWER SECTION itself won't be seen in the output if 10.0.4.0/24 is not allowed to use that nameserver.

  • Worked perfectly. Used dig -b 10.0.4.16 www.google.com @192.168.56.102 for verification. – user Oct 17 '14 at 0:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.