restrict resolve dns

[Yarka]

hi,
I have a zone (zone.a) on my dns server. I need that all hosts this zone can't access to others zones create (zone.b, zone.c, zone.d) in dns server, but if other zones can access to this zone.

For example:
When I do ping host1.zone.b from host belongs zone: zone.a, it musn't reply, but when I do ping host1.zone.a from host belongs zone: zone.b, it must reply.
How I have configure dns if my hosts are Windows?

Thanks.

 

[Grenage]

Well if they are on different subnets, and you don't have routes in place - that'd do it.

Carlsberg don't run I.T departments, but if they did they'd probably be more fun.

 

[Yarka]

Yes, they are on differents subnets, but I can resolve name of other subnets from this subnet,and it I don't want.

 

[chipk]

Yarka, what kind of DNS do you have? Windows, BIND?

Grenage, I don't believe leaving out routes would do what Yarka wants, and it would certainly break other stuff.

The reason being even if you break the routes between hosts on different subnets, they must still access the DNS server, which is where names are resolved from - although you'd receive a request timed out, or destination network unreachable when pinging, it would still resolve the name.

 

[Grenage]

Hmm, I see what you mean. Perhaps firewalls blocking the DNS port might do the job, I suppose it depends on the network topology.

Carlsberg don't run I.T departments, but if they did they'd probably be more fun.

 

[Yarka]

I have Windows

 

[Yarka]

how can I do that it doesn't resolve name? Only want that it resolves the names own domain and it doesn't resolve others domains.

thanks.

 

[majestrate]

If you're using Windows for DNS resolution, don't forward DNS requests.