![BIND9 拒绝来自本地本地网外 IP(外部 IP)的查询 - Ubuntu 14.04](https://linux22.com/image/72638/BIND9%20%E6%8B%92%E7%BB%9D%E6%9D%A5%E8%87%AA%E6%9C%AC%E5%9C%B0%E6%9C%AC%E5%9C%B0%E7%BD%91%E5%A4%96%20IP%EF%BC%88%E5%A4%96%E9%83%A8%20IP%EF%BC%89%E7%9A%84%E6%9F%A5%E8%AF%A2%20-%20Ubuntu%2014.04.png)
BIND9 在 Ubuntu 上拒绝来自本地本地网外 IP(外部 IP)的查询。
options {
listen-on port 53 { any; };
directory "/var/bind";
allow-query { any; };
allow-query-cache { any; };
allow-transfer { none; };
recursion no;
dnssec-validation auto;
auth-nxdomain no;
};
include "/etc/bind/zones.conf";
include "/etc/bind/reverse-zones.conf";
include "/etc/bind/named.conf.default-zones";
zone.conf 示例
zone "test.test" IN {
type slave;
file "zones/test.test.zone";
masters { 1.1.1.1; };
};
另外,我在日志中看到了拒绝,所以添加了allow-query-cache { any; };
但这没有什么区别。
日志:client 192.168.3.100#64088 (test.test.SUB.DOMAIN.INTERN): query (cache) 'test.test.SUB.DOMAIN.INTERN/A/IN' denied
运行“ nslookup test.test 172.1.1.5
”后(DNS 超时)
现在系统日志中没有显示任何异常。这是 BIND 在加载区域之前显示的内容(没有错误):
adjusted limit on open files from 4096 to 1048576
found 18 CPUs, using 18 worker threads
using 18 UDP listeners per interface
using up to 18432 sockets
loading configuration from '/etc/bind/named.conf'
reading built-in trusted keys from file '/etc/bind/bind.keys'
using default UDP/IPv4 port range: [1024, 65535]
using default UDP/IPv6 port range: [1024, 65535]
no IPv6 interfaces found
listening on IPv4 interface lo, 127.0.0.1#53
listening on IPv4 interface eth0, 172.1.1.5#53
generating session key for dynamic DNS
sizing zone task pool based on 162 zones
using built-in root key for view _default
set up managed keys zone for view _default, file 'managed-keys.bind'
command channel listening on 127.0.0.1#953
managed-keys-zone: loaded serial 2
zone 0.in-addr.arpa/IN: loaded serial 1
Var/Bind 位于非标准位置,但我在编辑 apparmor 配置文件后检查了日志,没有看到任何问题。
我可以成功查询来自同一子网的绑定。
/etc/default/bind9:
# run resolvconf?
RESOLVCONF=no
# startup options for the server
# OPTIONS="-u bind"
OPTIONS="-4 -u bind"
此更改是为了禁用 ipv6
我是一个 RHEL 人员 - 在 Centos7(1503) 上成功设置了服务器,并发现海外的从属设备想要运行 Ubuntu。所以这对我来说是一个操作系统配置错误,这很酷。
答案1
这是上游负载均衡器问题 - 响应被错误的 IP 接收,并被另一端的防火墙丢弃。