Bind9 - Domain management with Internet access?

Question

linux

I have a server on my home network.
There is a Mikrotik router with an external IP.
There is a bind9 DNS server with an internal IP of 192.168.2.11, and there is also a separate web server on NGINX with an internal IP of 192.168.2.20, Wirth is made on it. hosts that have been working for a long time - there are no problems with this for sure.

There is a site.ru domain, the registrar has my external IP as NS servers.
The router forwarded port 53 to my DNS server with IP 192.168.2.11

. I set up the dns zone - site.ru
Inside the local network everything works fine, BUT if you ping site. ru from the external Internet network, then the local address of the web server 192.168.2.20 is returned and the site itself does not open.

/etc/bind/named.conf

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
key rndc-key {
  algorithm hmac-md5;
  secret "PuYna7Wx/FFGcsK6VDrmbw==";
  };
controls {
  inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { rndc-key; };
  };

/etc/bind/named.conf.options

options {
directory "/var/cache/bind";

  forwarders {
    192.168.1.1;
    8.8.8.8;
    8.8.4.4;
    };
  dnssec-validation auto;
};

/etc/bind/named.conf.local

zone "site.ru" {
  type master;
  file "/var/lib/bind/site.ru.hosts";
  };

Well, setting up the zone itself

/var/lib/bind/site.ru.hosts

$ttl 3600
site.ru.	IN	SOA	dc. admin.site.ru. (
      1600627976
      3600
      600
      1209600
      3600 )
site.ru.	IN	NS	dc.
site.ru.	IN	A	192.168.2.20

Answer 1

Well, right, because you only have an A-record with an internal address in your zone file. You need to configure split-dns and give the inner zone only to internal clients, and the outer one - to external ones.