这是有关我的设置的一些信息。我的 LAN 子网中有一个主 DNS 服务器，在 Ubuntu 16.04 机器上运行。此外，我在其他各个子网（DMZ 子网、服务子网等）上还有一些从属 DNS 服务器。所有 DNS 从服务器都运行不同类型的 Linux。
由于我的主 DNS 服务器必须知道几个不同的子网，因此将其设置为分割 DNS/水平分割。
我的防火墙定义了三个区域：LAN、WAN 和 DMZ。出于安全原因，无法启动从 DMZ 到 LAN 的连接。连接必须从 LAN 子网发起。这是政策规定的，我不想改变它。
相关服务器的技术信息：
Master DNS on my LAN subnet:
OS: Ubuntu 16.04
Hostname: master.lan.mydomain.dk
IP: 192.168.1.4 255.255.255.0
Slave DNS on DMZ subnet:
OS: Debian 9
Hostname: tools.dmz.mydomain.dk
IP: 172.16.1.4 255.255.255.0
立即，我的水平分割设置在我的主服务器上运行良好。但我无法在主服务器和从服务器之间进行复制。没有区域文件的传输。
以下是相关的设置文件：
来自主 DNS 服务器的 name.conf：
key "rndc-key" {
algorithm hmac-md5;
secret "w26wwSa7rJB04IsuW99kGQ==";
};
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};
include "/etc/bind/named.conf.logging";
include "/etc/bind/named.conf.keys";
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
来自主 DNS 服务器的 name.conf.keys：
关键定义放置在单独的文件中，因此可以通过 rsync 轻松更新它们。
key lan-key {
algorithm HMAC-MD5;
secret AaEjmxhg3WT2;
};
key dmz-key {
algorithm HMAC-MD5;
secret BEhp4DeLnX4u;
};
key service-key {
algorithm HMAC-MD5;
secret 7rP4CN3Km2QT;
};
key management-key {
algorithm HMAC-MD5;
secret gNsRz2H7AxLH;
};
key update-key {
algorithm HMAC-MD5;
secret B88bqW33Fuap;
};
来自主 DNS 服务器的named.conf.local：
//
// Do any local configuration here
//
// Keys are defined in /etc/bind/named.conf.keys
//
acl lan-subnet {
!key dmz-key;
!key service-key;
!key management-key;
key lan-key;
127.0.0.0/8;
192.168.1.0/24;
};
acl dmz-subnet {
!key lan-key;
!key service-key;
!key management-key;
key dmz-key;
172.16.1.0/24;
};
acl service-subnet {
!key lan-key;
!key dmz-key;
!key management-key;
key service-key;
192.168.128.0/24;
};
acl management-subnet {
!key lan-key;
!key dmz-key;
!key service-key;
key management-key;
10.21.12.0/24;
};
view "internal" {
match-clients { lan-subnet; };
allow-recursion { any; };
allow-transfer { key lan-key; };
allow-update { key update-key; };
// prime the server with knowledge of the root servers
zone "." {
type hint;
file "/etc/bind/db.root";
};
// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912
zone "localhost" {
type master;
file "/etc/bind/db.local";
};
zone "127.in-addr.arpa" {
type master;
file "/etc/bind/db.127";
};
zone "0.in-addr.arpa" {
type master;
file "/etc/bind/db.0";
};
zone "255.in-addr.arpa" {
type master;
file "/etc/bind/db.255";
};
zone "lan.mydomain.dk" {
type master;
file "/etc/bind/internals/db.lan.mydomain.dk"; # zone file path
also-notify { 192.168.1.5 key lan-key; };
notify yes;
};
zone "1.168.192.in-addr.arpa" {
type master;
file "/etc/bind/internals/db.192.168.1-rev";
also-notify { 192.168.1.5 key lan-key; };
notify yes;
};
zone "dmz.mydomain.dk" {
type master;
file "/etc/bind/internals/db.dmz.mydomain.dk"; # zone file path
also-notify {
192.168.1.5 key lan-key;
172.16.1.4 key dmz-key;
172.16.1.5 key dmz-key;
127.0.0.1 key dmz-key;
};
notify yes;
};
zone "1.16.172.in-addr.arpa" {
type master;
file "/etc/bind/internals/db.172.16.1-rev";
also-notify {
192.168.1.5 key lan-key;
172.16.1.4 key dmz-key;
172.16.1.5 key dmz-key;
127.0.0.1 key dmz-key;
};
notify yes;
};
zone "service.mydomain.dk" {
type master;
file "/etc/bind/internals/db.service.mydomain.dk"; # zone file path
also-notify {
192.168.1.5 key lan-key;
192.168.1.10 key service-key;
192.168.1.11 key service-key;
127.0.0.1 key service-key;
};
notify yes;
};
zone "128.168.192.in-addr.arpa" {
type master;
file "/etc/bind/internals/db.192.168.128-rev";
also-notify {
192.168.1.5 key lan-key;
192.168.1.10 key service-key;
192.168.1.11 key service-key;
127.0.0.1 key service-key;
};
notify yes;
};
zone "management.mydomain.dk" {
type master;
file "/etc/bind/internals/db.management.mydomain.dk"; # zone file path
also-notify {
192.168.1.5 key lan-key;
10.21.12.4 key management-key;
127.0.0.1 key management-key;
};
notify yes;
};
zone "12.21.10.in-addr.arpa" {
type master;
file "/etc/bind/internals/db.10.21.12-rev";
also-notify {
192.168.1.5 key lan-key;
10.21.12.4 key management-key;
127.0.0.1 key management-key;
};
notify yes;
};
};
view "externals" {
match-clients { any; };
allow-recursion { none; };
allow-transfer { key dmz-key; };
zone "dmz.mydomain.dk" {
type slave;
masters { 127.0.0.1 key lan-key; };
file "/etc/bind/externals/db.dmz.mydomain.dk"; # zone file path
also-notify { 192.168.1.5 key dmz-key; };
};
zone "1.16.172.in-addr.arpa" {
type slave;
masters { 127.0.0.1 key lan-key; };
file "/etc/bind/externals/db.172.16.1-rev";
also-notify { 192.168.1.5 key dmz-key; };
};
};
view "services" {
match-clients { service-subnet; };
allow-recursion { none; };
allow-transfer { key service-key; };
zone "service.mydomain.dk" {
type slave;
masters { 127.0.0.1 key lan-key; };
file "/etc/bind/services/db.service.mydomain.dk"; # zone file path
also-notify { 192.168.1.5 key service-key; };
};
zone "128.168.192.in-addr.arpa" {
type slave;
masters { 127.0.0.1 key lan-key; };
file "/etc/bind/services/db.192.168.128-rev";
also-notify { 192.168.1.5 key service-key; };
};
};
view "management" {
match-clients { management-subnet; };
allow-recursion { none; };
allow-transfer { key management-key; };
zone "management.mydomain.dk" {
type slave;
masters { 127.0.0.1 key lan-key; };
file "/etc/bind/management/db.management.mydomain.dk"; # zone file path
also-notify { 192.168.1.5 key management-key; };
};
zone "12.21.10.in-addr.arpa" {
type slave;
masters { 127.0.0.1 key lan-key; };
file "/etc/bind/management/db.10.21.12-rev";
also-notify { 192.168.1.5 key management-key; };
};
};
来自主 DNS 服务器的 db.dmz.mydomain.dk：
$TTL 604800
@ IN SOA ns1.dmz.mydomain.dk. root.lan.mydomain.dk. (
2018102001 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
; name and mail servers - NS records
@ IN NS ns1.dmz.mydomain.dk.
IN NS ns2.dmz.mydomain.dk.
IN MX 10 proxymail.dmz.mydomain.dk.
IN A 172.16.1.4
; name servers - A records
ns1.dmz.mydomain.dk. IN A 172.16.1.4
ns2.dmz.mydomain.dk. IN A 172.16.1.5
; 172.16.1.0/24 - A records
fwdmz.dmz.mydomain.dk. IN A 172.16.1.2
tools.dmz.mydomain.dk. IN A 172.16.1.4
x3690.vmhost.dmz.mydomain.dk. IN A 172.16.1.20
x3650.vmhost.dmz.mydomain.dk. IN A 172.16.1.21
wwwgate.dmz.mydomain.dk. IN A 172.16.1.30
proxymail.dmz.mydomain.dk. IN A 172.16.1.40
来自从属 DNS 服务器的named.conf.local：
zone "dmz.mydomain.dk" {
type slave;
file "/etc/bind/slaves/db.dmz.mydomain.dk";
masters { 172.16.1.1 key dmz-key; };
};
zone "1.16.172.in-addr.arpa" {
type slave;
file "/etc/bind/slaves/db.172.16.1-rev";
masters { 172.16.1.1 key dmz-key; };
};
从上面可以看出，我将主IP地址设置为172.16.1.1，这是DMZ子网的网关地址。防火墙将任何 LAN 地址转换为 DMZ 网关地址，后跟随机端口号。因此将其放入主服务器的 LAN IP 地址是没有意义的，该地址永远不允许通过防火墙。
On the slave server there is the following error message:
"zone dmz.mydomain.dk/IN: refused notify from non-master: 172.16.1.1#47161".
所以，我可以理解为什么会出现错误消息，因为我只指定主服务器名为 172.16.1.1 而不是 172.16.1.1#47161。那么如何让从属服务器上的 Bind9 接受它不仅是一个 IP 地址，而且是一个 IP 地址和一个随机端口号？
提前致谢。
答案1
DNS BIND 传输使用更大的数据包/TCP 数据包。
您的问题可能是由于多年来 DNS 协议/DNS 数据包大小和/或支持 EDNS0 的 ASA 检查器发生变化所致。
默认情况下，ASA 将丢弃未通过 DNS 检查器规则的较大数据包。如果您喜欢 DNSSEC，也需要进行这些更改。
对于 ASA 8.2.2 及更高版本，执行以下操作：
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 4096
根据您的 ASA 版本，您可能还需要执行以下操作：
fixup protocol dns maximum-length 4096
fixup protocol dns 4096