Re: Action behind firewalls

["Todd S. Aven" <Todd.Aven@BankersTrust.Com>]

Walt,

We too have the split DNS configuration.  After I discovered for myself the
problem with using the 'forwarders' directive to resolve Internet names
through the firewall, I went through the code to find out why.  I discovered
the reason and found that neither the logic nor desirable alterations to the
logic were terribly complicated. 

I created a set of patches that can be applied to 4.9.3beta26 that introduce
a new named.boot keyword, 'noforward'.  Queries for names in domains
specified in a noforward line will *not* be forwarded to the Internet when
not in cache.

[begin CAVEATS]
Paul Vixie is contemplating a completely different model for controlling the
forwarding behavior which seems to be more flexible and desirable, so my code
changes are likely never to become part of the standard code base. 

Also, if you have many internal subdomains and contemplate using this
mechanism to allow you to take secondary service for those domains off the
forwarding server, you may be disappointed in the configurability:  you would
have to list *every* subdomain, as there is no wildcarding nor does the
exclusion principle apply to subdomains of a listed domain.
[end CAVEATS]

Having said all that, if anyone is interested in the patches, feel free 
to send me mail and I'll provide you with the changes.  

Regards,
Todd Aven
Todd.Aven@BankersTrust.Com