☰

拆分 DNS (bind9)、匹配客户端任何不起作用？

tag-icon • tag-icon debian networking dns bind
拆分 DNS (bind9)、匹配客户端任何不起作用？

过去几天我一直在为此奋斗。我的一些条目有外部和内部 IP。我的内部网络是10.0.0.0/8。

当我nslookup pc1.clase.net在内部时，它会返回 10.0.0.0 地址，但如果我nslookup pc1.clase.net在外部，它仍然会给我一个 10.0.0.0 地址。

我使用的是 Debian Wheezy。

命名配置文件

include "/etc/bind/named.conf.options";
view "internal" {
  match-clients { 10.0.0.0/8;};
  zone "clase.net"{
    type master;
    file "/etc/bind/internals/db.forward.net";
    allow-transfer { 10.0.0.11/8; }
  };
};
include "/etc/bind/named.conf.default-zones";

zone "10.in-addr.arpa" {
  type master;
  file "/etc/bind/internals/db.reverse.net";
  allow-transfer { 10.0.0.11/8;
  };
};
};

view "external" {
  match-clients { any; };
  zone "clase.net" {
    type master;
    file "/etc/bind/externals/db.forward.net";
    allow-transfer { 10.0.0.11/18;
    };
  };
};

内部/db.forward.net

$TTL    604800
@       IN      SOA     ns.clase.net. root.clase.net. (
                     2 ; Serial
                         604800 ; Refresh
                          86400 ; Retry
                        2419200 ; Expire
                         604800); Negative Cache TTL
;
@   IN  NS  ns.clase.net.
ns  IN  A   10.0.0.10
pc1 IN  A   10.0.0.12

外部/db.forward.net

$TTL    604800
@       IN      SOA     ns.clase.net. root.clase.net. (
                     2 ; Serial
                         604800 ; Refresh
                          86400 ; Retry
                        2419200 ; Expire
                         604800); Negative Cache TTL
;
@   IN  NS  ns
    IN  A   150.210.0.1
ns  IN  A   150.210.0.1
pc1 IN  A   150.210.0.22

答案1

终于知道怎么做了。

需要 TSIG 密钥来区分 2 个区域。

例子

答案2

不确定这是否是您的问题，但在查看您的配置文件时，似乎其中有一些拼写错误。

例子

该块看起来有太多右大括号 ( };)。

zone "10.in-addr.arpa" {
  type master;
  file "/etc/bind/internals/db.reverse.net";
  allow-transfer { 10.0.0.11/8;
  };
};
};

应该是这个吧？

zone "10.in-addr.arpa" {
  type master;
  file "/etc/bind/internals/db.reverse.net";
  allow-transfer { 10.0.0.11/8; }
};

文件的清理版本named.conf。

include "/etc/bind/named.conf.options";
view "internal" {
  match-clients { 10.0.0.10/24;};
  zone "clase.net" {
    type master;
    file "/etc/bind/internals/db.forward.net";
    allow-transfer { 10.0.0.11/8; };
  };
};

include "/etc/bind/named.conf.default-zones";

zone "10.in-addr.arpa" {
  type master;
  file "/etc/bind/internals/db.reverse.net";
  allow-transfer { 10.0.0.11/8; };
};

view "external" {
  match-clients { any; };
  zone "clase.net" {
    type master;
    file "/etc/bind/externals/db.forward.net";
    allow-transfer { 10.0.0.11/18; };
  };
};

客户端网络错误？

这些行对我来说看起来不正确：

view "internal" {
  match-clients { 10.0.0.0/8;};
  zone "clase.net"{
    type master;
    file "/etc/bind/internals/db.forward.net";
    allow-transfer { 10.0.0.11/8; }
  };
};

应该是这个吧？

view "internal" {
  match-clients { 10.0.0.0/8;};
  zone "clase.net"{
    type master;
    file "/etc/bind/internals/db.forward.net";
    allow-transfer { 10.0.0.0/8; }
  };
};

参考

答案3

- 来看看吧！

命名配置文件

// If you are just adding zones, please do that in /etc/bind/named.conf.local

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
include "/etc/bind/t-sig.key";

命名.conf.选项

acl internals {
                127.0.0.0/8;
                10.0.0.0/8;
              };

options {

    directory "/var/cache/bind";

    allow-recursion     { internals; };
    allow-query-cache   { internals; };
    allow-query         { internals; };

    dnssec-enable     yes;
    dnssec-validation yes;

     forwarders {

        // -Google - JUST FOR SAMPLE!!!
        8.8.4.4;
        8.8.8.8;

    };

    auth-nxdomain no;    # conform to RFC1035
    listen-on-v6 { any; };
};

命名.conf.local

include "/etc/bind/zones.rfc1918";

acl internals {
    127.0.0.0/8;
};

    zone "localhost" { 
        type master; 
        file "/etc/bind/db.local";
     };

};

命名.conf.默认区域

// prime the server with knowledge of the root servers

    zone "." {
        type hint;
        file "/etc/bind/db.root";
    };

// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912

    zone "sample.net" {
        type master;
        file "/etc/bind/db.sample.net";
        allow-query     { internals; };
        allow-transfer  { key t-sig.key; };  
    };

    zone "localhost" {
        type master;
        file "/etc/bind/db.local";
        allow-query { 127.0.0.0/8; };
        allow-transfer  { key t-sig.key; };
    };

    zone "127.in-addr.arpa" {
        type master;
        file "/etc/bind/127.in-addr.arpa";
        allow-query { 127.0.0.0/8; };
        allow-transfer  { key t-sig.key; };
    };

    zone "10.in-addr.arpa" {
        type master;
        file "/etc/bind/0.0.10.in-addr.arpa";
        allow-query { internals; };
        allow-transfer  { key t-sig.key; };
    };

    zone "0.in-addr.arpa" {
        type master;
        file "/etc/bind/0.in-addr.arpa";
        allow-query { internals; };
    };

    zone "255.in-addr.arpa" {
        type master;
        file "/etc/bind/255.in-addr.arpa";
        allow-query { internals; };
    };

相关内容