I'm trying to set up response policy on my existing Bind9 server because I'd like to override some of my company public domain to redirect them to our private network ips.
I've followed this tutorial : https://www.linuxbabe.com/ubuntu/set-up-response-policy-zone-rpz-in-bind-resolver-on-debian-ubuntu
However, I'm getting this error for the two domains I'm trying to override :
named[17104]: /etc/bind/zones/db.rpz:17: ignoring out-of-zone data (xxx.mydomain1.com)
named[17104]: /etc/bind/zones/db.rpz:19: ignoring out-of-zone data (yyy.mydomain2.com)
named[17104]: (re)loading policy zone 'rpz' changed from 0 to 2 qname, 0 to 0 nsdname, 0 to 0 IP, 0 to 0 NSIP, 0 to 0 CLIENTIP entries
named[17104]: zone rpz/IN: loaded serial 14
here's my configuration : named.conf.local :
zone "rpz" {
type master;
file "/etc/bind/zones/db.rpz";
allow-transfer { IP_DNS2; };
};
named.conf.options :
options {
...OPTIONS...
response-policy {
zone "rpz";
};
}
/etc/bind/zones/db.rpz :
;
; BIND data file for local loopback interface
;
$TTL 604800
@ IN SOA localhost.rpz. root.rpz. (
14 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
@ IN NS localhost.rpz.
localhost.rpz. A 127.0.0.1
xxx.mydomain.com. A PRIVATE_IP
yyy.mydomain2.com. A PRIVATE_IP
I decided to start over and copy db.empty to db.rpz and add the two domains and now it seems to work.
AFAIR LHS should NOT end in
.
in RPZ zone file.