☰

BIND 分割视图 DNS 无法与区域传输配合使用

tag-icon • tag-icon domain-name-system bind split-dns
BIND 分割视图 DNS 无法与区域传输配合使用

我正在设置两个 DNS 服务器。一个在防火墙/路由器上，另一个是内部服务器。我有很多设置 DNS 服务器的经验，所以这个问题特别令人困惑。

机器设置

防火墙外部地址：207.62.233.2
防火墙内部地址：10.24.0.1

辅助内部地址：10.24.0.21

主named.conf（仅相关部分）

options {
    listen-on port 53 { any; };
    listen-on-v6 port 53 { any; };
    directory   "/var/named";
    dump-file   "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    recursion yes;
};

view "internal" {
    match-clients { 10.24.0.0/16; 127.0.0.1; };

    match-recursive-only yes;
    allow-recursion { clients; };
    allow-transfer { 10.24.0.21; };

    zone "ct.sierracollege.edu" {
        type master;
        file "data/db.ct.int";
    };

    include "/etc/named.rfc1912.zones";

    zone "." IN {
        type hint;
        file "named.ca";
    };
};

view "external" {
    recursion no;
    match-clients { any; };
    allow-transfer { any; }; // temporarily allowed for debugging purposes

    zone "ct.sierracollege.edu" {
            type master;
            file "data/db.ct.ext";
    };
};

什么有效

防火墙上的拆分 DNS 效果很好。如果我从内部机器查询它，我会得到内部答案。同样，从外部机器查询它也会得到外部答案。这是一个内部查询。

# dig @10.24.0.1 ct1.ct.sierracollege.edu

; <<>> DiG 9.5.1-P2 <<>> @10.24.0.1 ct1.ct.sierracollege.edu
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51024
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;ct1.ct.sierracollege.edu.  IN  A

;; ANSWER SECTION:
ct1.ct.sierracollege.edu. 3600  IN  A   10.24.0.11

;; AUTHORITY SECTION:
ct.sierracollege.edu.   3600    IN  NS  cs.sierracollege.edu.
ct.sierracollege.edu.   3600    IN  NS  fw.ct.sierracollege.edu.

;; ADDITIONAL SECTION:
cs.sierracollege.edu.   3600    IN  A   10.24.0.21
fw.ct.sierracollege.edu. 3600   IN  A   10.24.0.1

;; Query time: 1 msec
;; SERVER: 10.24.0.1#53(10.24.0.1)
;; WHEN: Wed Jan  6 12:57:02 2010
;; MSG SIZE  rcvd: 124

什么不起作用

区域传输无法正常工作。它传输的是外部区域，而不是内部区域。以下是使用与上述相同的内部机器完成的示例：

# dig @10.24.0.1 ct.sierracollege.edu axfr

; <<>> DiG 9.5.1-P2 <<>> @10.24.0.1 ct.sierracollege.edu axfr
; (1 server found)
;; global options:  printcmd
ct.sierracollege.edu.   3600    IN  SOA ct.sierracollege.edu. root.ct.sierracollege.edu. 3 3600 1800 604800 3600
ct.sierracollege.edu.   3600    IN  NS  fw.ct.sierracollege.edu.
ct1.ct.sierracollege.edu. 3600  IN  A   207.62.233.11
ct2.ct.sierracollege.edu. 3600  IN  A   207.62.233.12
ct3.ct.sierracollege.edu. 3600  IN  A   207.62.233.13
fw.ct.sierracollege.edu. 3600   IN  A   207.62.233.2
ct.sierracollege.edu.   3600    IN  SOA ct.sierracollege.edu. root.ct.sierracollege.edu. 3 3600 1800 604800 3600
;; Query time: 2 msec
;; SERVER: 10.24.0.1#53(10.24.0.1)
;; WHEN: Wed Jan  6 13:01:37 2010
;; XFR size: 7 records (messages 1, bytes 208)

/var/log/messages 文件中的条目显示外部视图正在被访问：

Jan  6 13:01:37 fw named[17572]: client 10.24.0.21#42362: view external: transfer of 'ct.sierracollege.edu/IN': AXFR started
Jan  6 13:01:37 fw named[17572]: client 10.24.0.21#42362: view external: transfer of 'ct.sierracollege.edu/IN': AXFR ended

因此，我的slaves目录中充满了外部区域文件，而不是内部区域文件。

有任何想法吗？

答案1

您尝试过使用 ACL 吗？听起来很有趣，我知道。另外，为什么要启用 match-recursive-only？这是否会让您的客户端仅在执行递归查询时才获得结果？

acl "internal-net" { 
    10.24.0.0/16; 127/8;
};

view "internal" {
    match-clients { "internal-net"; };

    # --- I'm removing this because I'm making the daft assumption
    # --- that you are trusting your clients on your internal network,
    # --- so why bother restricting them?  Then there's this tidbit
    # --- from http://www.zytrax.com/books/dns/ch7/view.html#match-recursive-only
    # --- which seems to imply that the client match will fail because
    # --- the client might not be asking for recursion...
    #match-recursive-only yes;

    allow-recursion { "internal-net"; };
    allow-transfer { "internal-net"; };

    zone "ct.sierracollege.edu" {
        type master;
        file "data/db.ct.int";
    };

    include "/etc/named.rfc1912.zones";

    zone "." IN {
       type hint;
       file "named.ca";
    };
};

相关内容