BIND: Slave zone to Master zone(Windows 2012 DC) doesn't work
I've searched and then tried inquiring with a few posts with no luck. So I'm reattempting again with a more detailed post about my setup.
WAN aka em0
Interface IP: 184.108.40.206
LAN aka em1
Interface IP: 192.168.1.1
DHCP: range 192.168.1.100-199
Got a static NAT of 220.127.116.11(external) => 192.168.1.200(internal)
OPT1 aka em2
Interface IP: 18.104.22.168
DHCP: range of 22.214.171.124-245
DHCP being served to a couple of Windows 7 VMs
Windows 2012 DC; also setup as DNS server; has static IP of 126.96.36.199
BIND master zone config file:
; Database file example.com.DB for example.com zone.
; Do not edit this file!!!
; Zone version 2437079441
example.com. IN SOA fw.example.com. example.com. (
2437079441 ; serial
1d ; refresh
2h ; retry
4w ; expire
1h ; default_ttl
; Zone Records
@ IN NS fw.example.com.
@ IN A 188.8.131.52
www IN CNAME fw.example.com.
fw.example.com. IN A 184.108.40.206
appl.example.com. IN A 220.127.116.11
littlesheep.example.com. IN A 18.104.22.168
;custom zone records
@ IN NS ec2.example.org.
localhost IN A 127.0.0.1
Master zone works as clients on LAN and OPT1 interfaces resolve the defined zone records.
Setup Windows 2012 as subdomain and called the new forest littlesheep.example.com; FQDN is shepherd.littlesheep.example.com
Setup same Windows 2012 DC as DNS server
In pfsense>BIND, setup ACL, Views, slave zone for littlesheep
3a) ACL includes
22.214.171.124(Windows 7 with hostname baaah)
126.96.36.199(Windows 7 with hostname lambchop)
188.8.131.52(Windows 2012 DC with DNS)
3b) View Name is "littlesheep
3c) Zone Name is littlesheep.example.com
Zone Type "slave"
Master Zone IP "184.108.40.206"
Zone Domain Records:
www cname littlesheep.example.com.
littlesheep.example.com. A 220.127.116.11
appl.example.com. A 18.104.22.168
fw.example.com. A 22.214.171.124
WHERE I'M STUCK
- On shepherd(DC), I set it to all transfer for ANY. I go to one of my Windows 7 box and try to join it to littlesheep.example.com, I get this message:
The following error occurred when DNS was queried for the service location (SRV) resource record used to locate an Active Directory Domain Controller (AD DC) for domain "littlesheep.example.com":
The error was: "DNS name does not exist."
(error code 0x0000232B RCODE_NAME_ERROR)
The query was for the SRV record for _ldap._tcp.dc._msdcs.littlesheep.example.com
Common causes of this error include the following:
- The DNS SRV records required to locate a AD DC for the domain are not registered in DNS. These records are registered with a DNS server automatically when a AD DC is added to a domain. They are updated by the AD DC at set intervals. This computer is configured to use DNS servers with the following IP addresses:
- One or more of the following zones do not include delegation to its child zone:
. (the root zone)
I thought by setting up the slave zone with the littlesheep view, the Windows 7 VMs should be able to join the domain but it doesn't. When I'm at the Windows 7 VM, I can ping littlesheep.example.com and it resolves. If I'm on the Windows 7 VMs, and I manually add the DC IP 126.96.36.199 in the DNS field in network properties, I can join the domain. But on the Windows 7 VM, DHCP DNS address is of the pfsense(188.8.131.52), it won't join.
Any ideas what's happening here?