BIND DNS 递归仅到我的域

Question

我被要求仅允许对属于特定域的客户端进行递归。我想我可以转到我的named.conf并在选项区域添加以下行： allow-recursion { myDomain ; }; 但后来我意识到这是一个巨大的错误，有没有办法允许 DNS 递归到我的域中的客户端，而不必在列表上写下每个 IP 地址allow-recursion{};？

Answer 1

如果存在特定的子网，则可以通过以下方式允许递归：

acl trustednets {
    # server itself
    localhost;
    # the subnet
    192.0.2.0/24;
    # any others... (BIND also has a "localnets" to trust
    # connected subnets, if that is appropriate)
};
options {
    ...
    allow-recursion { trustednets; };
};

另一种选择是使用视图；这可能适合向公众开放且也可由客户端系统使用的 DNS 服务器，但更为复杂：

acl trustednets {
    ...  # as above
};
view favoredclients {
    match-clients      { trustednets; };
    match-destinations { trustednets; };
    recursion yes;
    zone ...  # zones probably best done via include
};
view thewashedmasses {
    recursion no;
    # https://rhn.redhat.com/errata/RHSA-2013-0550.html
    rate-limit {
            responses-per-second 5;
            window 5;
    };
    zone ...  # best done via include (because duplicated here)
};