☰

BIND 区域传输，接收响应时失败：NXDOMAIN

tag-icon • tag-icon debian ubuntu bind
BIND 区域传输，接收响应时失败：NXDOMAIN

在我为这个问题绞尽脑汁两天后，现在我需要社区的支持，以确保我不会糊涂或遗漏一些东西。 （（请原谅我的英语，这不是我的母语））

我不断从我的从服务器收到错误消息：

Feb  9 14:28:15 orzech-pie named[7300]: client @0xffff9c0062c8 172.16.40.1#57648: received notify for zone 'llair.lan'
Feb  9 14:31:18 orzech-pie named[7300]: zone llair.lan/IN: Transfer started.
Feb  9 14:31:18 orzech-pie named[7300]: transfer of 'llair.lan/IN' from 172.16.40.1#53: connected using 172.16.40.1#53
Feb  9 14:31:18 orzech-pie named[7300]: transfer of 'llair.lan/IN' from 172.16.40.1#53: failed while receiving responses: NXDOMAIN
Feb  9 14:31:18 orzech-pie named[7300]: transfer of 'llair.lan/IN' from 172.16.40.1#53: Transfer status: NXDOMAIN
Feb  9 14:31:18 orzech-pie named[7300]: transfer of 'llair.lan/IN' from 172.16.40.1#53: Transfer completed: 0 messages, 0 records, 0 bytes, 0.023 secs (0 bytes/sec) (serial 0)

配置位于通过wireguard连接的2个站点之间，主站是debian系统，从站是ubuntu系统。 在此输入图像描述

命名.conf.选项主服务器的：

options {
      directory "/var/lib/bind";
      version "Orzech! v15.2.1";

      // Disable empty zones
      empty-zones-enable no;

      // DoH Proxy Forwarder
      forwarders { 127.0.0.1 port 5053; };

      // ACL for zone transfer
      allow-transfer { any; };

      // No IPv6
      listen-on-v6 { none; };
      // Listen on these adresses
      listen-on port 53 { 172.16.40.1; 127.0.0.1; };

      // Added Per Debian buster Bind9.
      // Due to : resolver: info: resolver priming query complete messages in the logs.
      // See: https://gitlab.isc.org/isc-projects/bind9/commit/4a827494618e776a78b413d863bc23badd14ea42
      // minimal-responses no;

      //  AC for queries
      allow-query { any; };
      allow-query-cache { any; };

      //  AC for recursive queries
      recursion yes;
      allow-recursion { any; };

      // https://wiki.samba.org/index.php/Dns-backend_bind
      // DNS dynamic updates via Kerberos (optional, but recommended)
      tkey-gssapi-keytab "/var/lib/samba/private/dns.keytab";

  };

命名.conf.local主服务器文件：

// Do any local configuration here
// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

include "/var/lib/samba/bind-dns/named.conf";

zone "llair.lan" IN {

     type master;

     file "/etc/bind/forward.llair.lan.db";

     allow-update { any; };
     also-notify { 172.16.69.252; }; //Notify slave for zone changes

};

转发.llair.lan.db主服务器上的文件：

$ORIGIN llair.lan.
$TTL 86400
@               IN      SOA     domain-orzech.llair.lan.        webmaster.llair.lan. (
                                2024020901 ; serial
                                21600      ; refresh after 6 hours
                                3600       ; retry after 1 hour
                                604800     ; expire after 1 week
                                86400 )    ; minimum TTL of 1 day

; NS Records
                IN      NS      domain-orzech.llair.lan.
                IN      NS      orzech-pie.llair.lan.


; Nameserver IPs
domain-orzech   IN      A       172.16.40.1
orzech-pie      IN      A       172.16.69.252

; Single A Records
docker-orzech   IN      A       172.16.40.2
web-orzech      IN      A       172.16.40.3

; Multirecords
utm-orzech      IN      A       172.16.40.254
                IN      A       172.16.45.254

命名.conf.选项从属服务器的：

options {
      directory "/var/cache/bind";
      version "Orzech! v15.2.1";

      // Disable empty zones
      empty-zones-enable no;

      // DoH Proxy Forwarder
      forwarders { 127.0.0.1 port 5053; };

      // Listen on all IPv6 adresses
      listen-on-v6 { any; };
      // Listen on these adresses
      listen-on port 53 { 172.16.69.252; 127.0.0.1; };

      // Added Per Debian buster Bind9.
      // Due to : resolver: info: resolver priming query complete messages in the logs.
      // See: https://gitlab.isc.org/isc-projects/bind9/commit/4a827494618e776a78b413d863bc23badd14ea42
      //minimal-responses yes;

      //  AC for queries
      allow-query { any;  };
      allow-query-cache { any; };

      // AC for recursive queries
      recursion yes;
      allow-recursion {  any; };

  };

命名.conf.local从服务器文件：

//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

zone "llair.lan" IN {

     type slave;

     file "/var/cache/bind/forward.llair.lan.db";

     masters { 172.16.40.1; };

};

在从服务器上执行 dig 会导致查询成功：

usr@orzech-pie:~$ dig @172.16.40.1 llair.lan

; <<>> DiG 9.18.18-0ubuntu0.22.04.1-Ubuntu <<>> @172.16.40.1 llair.lan
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7531
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: dbfabed0530373340100000065c631b364eaf777b7ab38b5 (good)
;; QUESTION SECTION:
;llair.lan.                     IN      A

;; AUTHORITY SECTION:
llair.lan.              86400   IN      SOA     domain-orzech.llair.lan. webmaster.llair.lan. 2024020901 21600 3600 604800 86400

;; Query time: 19 msec
;; SERVER: 172.16.40.1#53(172.16.40.1) (UDP)
;; WHEN: Fri Feb 09 15:07:47 CET 2024
;; MSG SIZE  rcvd: 126

那么，我的错误在哪里。是否可能是我没有对 WireGuard 流量进行标准化，或者我的配置有问题。已经感谢您的支持了。

编辑：我禁用了所有 ACL 并将其替换为任何 ACL，但仍然没有成功。

答案1

我找到了问题所在。我应该先检查 netstat 和我的 samba 配置。Netstat 显示 samba dns 任务仍处于启用状态，在检查了 samba wiki 之后，我不得不添加server services = -dns以禁用它。

没有你的帮助就找不到它。谢谢。

相关内容