You need to recompile kernel to enable IPTABLES support. I am giving the steps to enable IPTABLES support during kernel recompilation.

Select the following option (not as a loadable module)

Networking >> Networking options >> Network packet filtering (replaces ipchains) >> Core Netfilter Configuration >> Netfilter Xtables support (required for ip_tables) and select the all following options as modules.

A server is limited to a certain number of TCP/IP connections that it can keep track of.

ip_conntrack is a module which has the limit set in its conntrack database. If the table exceeds this limit, even the legitimate packets will be dropped.

We usually tweak this parameter in the sysctl.conf file.

You can use the following steps to uninstall apf in a linux machine:

Stop the apf service running in the server.

Remove the apf files from the server.

Disable apf in the run levels.

Open up and remove this line:

It is sometimes easy to make changes in named.conf file or in any zone files manually though the control panel has options to modify them. If the changes are being made manually, we should also make sure that the configuration as well as the zone files are not being messed up.

The bind package has utilities to check the syntax of named.conf and any zone files. We can make use of those binaries to check our modifications done to those files before reloading or restarting named service.

To check the sytax of zone file /var/named/kb.com.db for the domain kb.com,

[root@bash ~]# named-checkzone kb.com /var/named/kb.com.db
zone kb.com/IN: loaded serial
OK
[root@ bash~]#

If everything is correct, it will show the serial number with which the zone file is loaded. Otherwise, it will give error message indicating the line number at which the error occured.

To check the syntax of named.conf file,

[root@bash ~]# named-checkconf /etc/named.conf
[root@bash~]#

You may also load the configuration of all master zones listed in named.conf at the time of checking the syntax as,

[root@bash ~]# named-checkconf -z /etc/named.conf
zone localdomain/IN: loaded serial 42
zone localhost/IN: loaded serial 42
zone 0.0.127.in-addr.arpa/IN: loaded serial
zone 255.in-addr.arpa/IN: loaded serial 42
zone 0.in-addr.arpa/IN: loaded serial 42
zone kb.com/IN: loaded serial
[root@bash ~]#

The command will show a detailed output in case any error in named.conf file.

This way we can make sure that we are not editing the configuration file wrongly.

What is split DNS

It is an advanced concept, and in which, the DNS server is configured to respond to the same query differently, based on the hosts accessing it. It is done by configuring different views or visibility in name server. A typical example is, how DNS server responds to the queries from the same server and the queries from outside of the server. The view clause is available with BIND 9.x, and hence the latest release of Cpanel is using this concept.

Configuration

In this configuration, we will be considering only two views to the name server. One is internal and other is external. The internal view is
responsible for handling queries from within the server, and the external view, responsible for managing queries from outside the server.

In the following example, we consider adding a domain name say “example.com” to the internal view as well as the external view.

view “internal” {
match-clients        { localnets; };
match-destinations    { localnets; };
recursion yes;

zone “.” IN {
type hint;
file “/var/named/named.ca”;
};

zone “example.com” {
type master;
file “/var/named/example.com.db”;
};
};

view    “external” {
recursion no;

zone “.” IN {
type hint;
file “/var/named/named.ca”;
};

zone “example.com” {
type master;
file “/var/named/example.com.db”;
};
};

A view is matched against a particular query based on match-clients or match-destinations statements in the view clause. In the above example, view “internal” has the following statements.

match-clients        { localnets; };
match-destinations    { localnets; };

Here, the match-clients matches source IP address of the host and match-destinations matches the destination IP address specified in DNS request. It is specified as “localnets”. It is a builtin macro, which matches any hosts on that network. Other bulitin macros are the following:

any – allows all hosts
none – denies all hosts
localhost – allows IP address of all interface on the system

If we haven’t defined any match statements, it will default to any and allows request from any hosts.

So, in our example, view “internal” will be allowing requests from all the IPs that are configured on the server. Since view “external” doesn’t have any match statements, it will allow queries from anywhere.

In this example, we allow recursive query only within the server. In view “external”, the recursive query is disabled.

Conclusion

We can configure the a single DNS server to behave differently by defining appropriate views. There is no need to run separate DNS servers for internal as well as external networks. We can also make some restrictions, just like the way, we disabled recursion for queries from outside the server.