Bug #8567

Smart Proxy BIND incorrect reverse DNS config for networks smaller than /24

Added by John Brooker almost 5 years ago. Updated about 2 years ago.

Bugzilla link:
Pull request:
Fixed in Releases:
Found in Releases:


The foreman configures the reverse zone for DNS allow with forward zones under certain circumstances.

This is fine if you have a /24 network. but for other networks, such as it add's an incorrect zone entry like the one below:

zone "" {
    type master;
    file "/var/cache/bind/zones/";
    update-policy {
            grant rndc-key zonesub any;

bind can only handle zone files in /24, /16 or /8 increments. as a result the above entry is invalid, causing updates to it to fail.

Heres what I had to do to work around it temporarily:

cd /var/cache/bind/zones/
sudo mv
sudo sed -i '' /etc/bind/zones.conf

Bottomline: any reverse DNS zones in bind need to be rounded up to X.X.X.*, X.X.*.* or X.*.*.*

Perhaps this would be fixed if I set the network address in the subnet definition to be 15.8.10, but that is not the right network address for this range.


#1 Updated by Dominic Cleal almost 5 years ago

  • Project changed from Foreman to Installer
  • Category changed from DNS to Foreman modules

Can you explain how you installed Foreman? I assume you're talking about the installer, but the installer has a --foreman-proxy-dns-reverse argument that you have to set for the reverse DNS zone name, so perhaps check what value you supplied.

#2 Updated by Dominic Cleal almost 5 years ago

  • Status changed from New to Need more information

#3 Updated by John Brooker almost 5 years ago

Good question. what I did was I used the GUI, which in one of the steps instructed me to use the foreman-installer command. I had previously used foreman-installer to setup foreman, using just a single host for both proxy and head BTW.

ok. so the command I got out of that setup included the following flag for foreman-installer: \

This is incorrect for the reasons I described above. here is what it should be: \

NOTE: the missing "64."

so the logic that generates that flag needs a tweak to ensure it always removes the last octet from the network address provided on the previous page.

BTW you can't work around this issue by shortening the network address to just 3 octets. that will throw an "address family mismatch" error

I would also argue that some amount of sanity checking needs to occur on the smart proxy side to stop these zones from being generated.

Couple of other important notes:
  • There is an RFC (2317) which allows for the generation of sub-octet sized reverse lookup zones. googling for that finds a litany of issues, so although enabling that support in bind (assuming it exists) would solve this issue, it seems like it would be problematic and thus a poor choice for a default way of operating.
  • A full list of DNS RFC's are linked below. I didn't take the time to read through them but I'm sure that since RFC 2317 exists theres and RFC that establishes the problem that RFC 2317 addresses as the norm:

#4 Updated by Dominic Cleal almost 5 years ago

  • Project changed from Installer to foreman_setup
  • Category deleted (Foreman modules)
  • Status changed from Need more information to New

Thanks for the info, that makes more sense now, part of foreman_setup.

#5 Updated by Antoine Cotten over 4 years ago

I also face a similar issue on Foreman 3.7.1 with the following subnet:

When I create or edit a host on this subnet, the following messages appear in the proxy logs:

E, [2015-01-19T13:07:02.990181 #29026] ERROR -- : Cannot find DNS entry for - - [19/Jan/2015 13:07:02] "DELETE /dns/ HTTP/1.1" 404 52 0.0092

Foreman should actually try to add the following entry when the subnet is not one of /24, /16 or /8:


Associated zone:

zone "" {
    file "/var/named/dynamic/";

And the corresponding zone file:

$TTL 10800    ; 3 hours IN SOA (
                2015000002 ; serial
                86400      ; refresh (1 day)
                3600       ; retry (1 hour)
                604800     ; expire (1 week)
                3600       ; minimum (1 hour)

#6 Updated by Diego Michelotto about 2 years ago

Dear all,

any news about this BUG, we have the same problem with Foreman 1.15.

All the best

Also available in: Atom PDF