我已将我的 ubuntu 18.04 服务器设置为仅缓存转发 DNS 服务器：
cat named.conf.options
options {
directory "/var/cache/bind";
recursion yes;
allow-query { 0.0.0.0; 127.0.0.1;};
forwarders {
8.8.8.8;
8.8.4.4;
};
forward only;
dnssec-enable yes;
dnssec-validation yes;
auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
};
服务器上的防火墙设置：
ufw status
Status: active
To Action From
-- ------ ----
Apache ALLOW Anywhere
Bind9 ALLOW Anywhere
22/tcp ALLOW Anywhere
OpenSSH ALLOW Anywhere
Apache (v6) ALLOW Anywhere (v6)
Bind9 (v6) ALLOW Anywhere (v6)
22/tcp (v6) ALLOW Anywhere (v6)
journalctl 的输出：
journalctl -u bind9 -f
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f8101100 90.248.149.235#43049 (ssl.gstatic.com): query (cache) 'ssl.gstatic.com/A/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f810f890 90.248.149.235#43049 (ssl.gstatic.com): query (cache) 'ssl.gstatic.com/AAAA/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f810f890 90.248.149.235#43049 (ssl.gstatic.com): query (cache) 'ssl.gstatic.com/A/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f811e020 90.248.149.235#43049 (ssl.gstatic.com): query (cache) 'ssl.gstatic.com/AAAA/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f811e020 90.248.149.235#50650 (ssl.gstatic.com.broadband): query (cache) 'ssl.gstatic.com.broadband/A/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f810f890 90.248.149.235#50650 (ssl.gstatic.com.broadband): query (cache) 'ssl.gstatic.com.broadband/AAAA/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f810f890 90.248.149.235#50650 (ssl.gstatic.com.broadband): query (cache) 'ssl.gstatic.com.broadband/A/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f8101100 90.248.149.235#50650 (ssl.gstatic.com.broadband): query (cache) 'ssl.gstatic.com.broadband/AAAA/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f811e020 90.248.149.235#45883 (ssl.gstatic.com): query (cache) 'ssl.gstatic.com/AAAA/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f8101100 90.248.149.235#45883 (ssl.gstatic.com): query (cache) 'ssl.gstatic.com/A/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f8101100 90.248.149.235#45883 (ssl.gstatic.com): query (cache) 'ssl.gstatic.com/A/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f811e020 90.248.149.235#45883 (ssl.gstatic.com): query (cache) 'ssl.gstatic.com/AAAA/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f8101100 90.248.149.235#51677 (ssl.gstatic.com.broadband): query (cache) 'ssl.gstatic.com.broadband/AAAA/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f811e020 90.248.149.235#51677 (ssl.gstatic.com.broadband): query (cache) 'ssl.gstatic.com.broadband/A/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f811e020 90.248.149.235#51677 (ssl.gstatic.com.broadband): query (cache) 'ssl.gstatic.com.broadband/A/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f8101100 90.248.149.235#51677 (ssl.gstatic.com.broadband): query (cache) 'ssl.gstatic.com.broadband/AAAA/IN' denied
在我的家用笔记本电脑（ubuntu 18.04）上设置：
cat /etc/resolv.conf
nameserver 164.132.173.129
#nameserver 127.0.0.53
options edns0
search broadband
我通过注释掉每个名称服务器并尝试 dig 和 ping 命令来在名称服务器之间切换。当我尝试使用安装了 bind9 的服务器时，ping 命令不起作用：
dig google.com
; <<>> DiG 9.11.3-1ubuntu1.11-Ubuntu <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 38769
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: ab489ac00252b38c3427db005e3eb469c1411fa2c18cecdf (good)
;; QUESTION SECTION:
;google.com. IN A
;; Query time: 16 msec
;; SERVER: 164.132.173.129#53(164.132.173.129)
;; WHEN: Sat Feb 08 13:15:21 GMT 2020
;; MSG SIZE rcvd: 67
这是 ping 的输出：
ping -c 5 google.com
ping: google.com: Name or service not known
谁能告诉我为什么我的 DNS 服务器不能按预期工作？
答案1
您在允许查询中缺少“90.248.149.235；”
你可能还需要
允许递归{90.248.149.235;};
顺便说一句：您可以使用“dig google.com @164.132.173.129”而无需更改 resolv.conf