![GeoIP 拆分 DNS 错误第三视图](https://linux22.com/image/726943/GeoIP%20%E6%8B%86%E5%88%86%20DNS%20%E9%94%99%E8%AF%AF%E7%AC%AC%E4%B8%89%E8%A7%86%E5%9B%BE.png)
已成功配置 Bind 以使用 TSIG 托管多个视图指导问题是,当我添加第三个视图时,事情变得很奇怪。
在每台服务器上,我现在有 3 个视图:
- 美国
- 欧洲
- 中国
我添加中国视图后,从服务器使用欧洲视图,而它本应使用中国视图。当我从中国主机查询主服务器时,它使用正确的视图。我已经验证了两台服务器上的密钥,虽然我的从服务器的 geoip 会与欧洲视图匹配,但我已从欧洲视图中删除 geoip 语句以确保它仍然匹配。
两台服务器上的 ACL:
acl "USA" {
key usa-key;
!key europe-key;
!key china-key;
geoip country US;
};
acl "Europe" {
key europe-key;
!key usa-key;
!key china-key;
geoip country NO;
};
acl "China" {
key china-key;
!key usa-key;
!key europe-key;
geoip country CN;
};
掌握:
view "USA" {
match-clients { USA; };
allow-transfer { key usa-key; };
zone "domain.net." {
type master;
also-notify { $slave_server key usa-key; };
file "/etc/bind/domain.net/na.domain.net.zone";
};
zone "3.2.1.in-addr.arpa." {
type master;
also-notify { $slave_server key usa-key; };
file "/etc/bind/domain.net/na.domain.net.rev";
};
zone "doma.net." {
type master;
also-notify { $slave_server key usa-key; };
file "/etc/bind/domain.net/na.doma.net.zone";
};
zone "9.8.7.in-addr.arpa." {
type master;
also-notify { $slave_server key usa-key; };
file "/etc/bind/domain.net/na.doma.net.rev";
};
};
view "Europe" {
match-clients { Europe; };
allow-transfer { key europe-key; };
zone "domain.net." {
type master;
also-notify { $slave_server key europe-key; };
file "/etc/bind/domain.net/eu.domain.net.zone";
};
zone "3.2.1.in-addr.arpa." {
type master;
also-notify { $slave_server key europe-key; };
file "/etc/bind/domain.net/eu.domain.net.rev";
};
zone "doma.net." {
type master;
also-notify { $slave_server key europe-key; };
file "/etc/bind/domain.net/eu.doma.net.zone";
};
zone "9.8.7.in-addr.arpa." {
type master;
also-notify { $slave_server key europe-key; };
file "/etc/bind/domain.net/eu.doma.net.rev";
};
};
view "China" {
match-clients { China; };
allow-transfer { key china-key; };
zone "domain.net." {
type master;
also-notify { $slave_server key china-key; };
file "/etc/bind/domain.net/cn.domain.net.zone";
};
zone "3.2.1.in-addr.arpa." {
type master;
also-notify { $slave_server key china-key; };
file "/etc/bind/domain.net/cn.domain.net.rev";
};
zone "doma.net." {
type master;
also-notify { $slave_server key china-key; };
file "/etc/bind/domain.net/cn.doma.net.zone";
};
zone "9.8.7.in-addr.arpa." {
type master;
also-notify { $slave_server key china-key; };
file "/etc/bind/domain.net/cn.doma.net.rev";
};
};
奴隶:
view "USA" {
match-clients { USA; };
zone "domain.net." {
type slave;
masters { $master_server key usa-key; };
file "/var/lib/bind/na.domain.net.zone";
};
zone "3.2.1.in-addr.arpa." {
type slave;
masters { $master_server key usa-key; };
file "/var/lib/bind/na.domain.net.rev";
};
zone "doma.net." {
type slave;
masters { $master_server key usa-key; };
file "/var/lib/bind/na.doma.net.zone";
};
zone "9.8.7.in-addr.arpa." {
type slave;
masters { $master_server key usa-key; };
file "/var/lib/bind/na.doma.net.rev";
};
};
view "Europe" {
zone "domain.net." {
type slave;
masters { $master_server key europe-key; };
file "/var/lib/bind/eu.domain.net.zone";
};
zone "3.2.1.in-addr.arpa." {
type slave;
masters { $master_server key europe-key; };
file "/var/lib/bind/eu.domain.net.rev";
};
zone "doma.net." {
type slave;
masters { $master_server key europe-key; };
file "/var/lib/bind/eu.doma.net.zone";
};
zone "9.8.7.in-addr.arpa." {
type slave;
masters { $master_server key europe-key; };
file "/var/lib/bind/eu.doma.net.rev";
};
};
view "China" {
zone "domain.net." {
type slave;
masters { $master_server key china-key; };
file "/var/lib/bind/ch.domain.net.zone";
};
zone "3.2.1.in-addr.arpa." {
type slave;
masters { $master_server key china-key; };
file "/var/lib/bind/ch.domain.net.rev";
};
zone "doma.net." {
type slave;
masters { $master_server key china-key; };
file "/var/lib/bind/ch.doma.net.zone";
};
zone "9.8.7.in-addr.arpa." {
type slave;
masters { $master_server key china-key; };
file "/var/lib/bind/ch.doma.net.rev";
};
};
完全没主意了。如果有人知道我做错了什么,我将非常感激您的回复。
答案1
在从属配置中,您的和视图match-clients
中缺少指令。Europe
China
根据视图的工作方式(使用第一个匹配的视图),所有与您的USA
视图(具有其match-clients
指令)不匹配的查询,其他所有内容将进入下一个视图(您的Europe
视图,它与任何内容匹配),并且最后一个视图(您的China
视图,它也会匹配任何内容,只是此时没有不匹配的查询)。
值得注意的是,你可能想要某物是万能的。也就是说,如果查询与任何国家/地区都不匹配,您可能仍希望得到正确的响应?