☰

DNS 仅转发/代理服务器以 SERVFAIL 响应

tag-icon • tag-icon domain-name-system centos7 bind internal-dns
DNS 仅转发/代理服务器以 SERVFAIL 响应

我们有一个内部 DNS 服务器 64.104.128.236，只能在特定子网 (10.106.xx/16) 内访问。我正在构建一个私有网络 (192.168.xx/16)，希望从该网络使用 64.104.128.236 来解析 DNS 查询

现在我已经设置了一个带有接口的代理服务器（CentOS 7.5）-

  1. 10.106.179.30可以访问DNS服务器
  2. 192.168.180.100 用于私网内通信

我已经在代理服务器上安装了 bind-utils，其配置如下/etc/named.conf：

options {
    listen-on port 53 { 127.0.0.1; any; };
    listen-on-v6 port 53 { ::1; };
    directory   "/var/named";
    dump-file   "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    recursing-file  "/var/named/data/named.recursing";
    secroots-file   "/var/named/data/named.secroots";
    allow-query     { localhost; any; };
    recursion yes;

    forwarders { 64.104.128.236; };
    forward only;

    dnssec-enable yes;
    dnssec-validation yes;
};

从我的客户端（192.168.180.81），当我尝试 nslookup 时，我总是得到 SERVFAIL

> facebook.com
Server:     192.168.180.100
Address:    192.168.180.100#53

------------
    QUESTIONS:
    facebook.com, type = A, class = IN
    ANSWERS:
    AUTHORITY RECORDS:
    ADDITIONAL RECORDS:
------------
** server can't find facebook.com: SERVFAIL

我可以看到它在我的代理服务器中被成功解析，但是并没有被传递下去。

[root@warmachine ~]# nslookup facebook.com
Server:     64.104.128.236
Address:    64.104.128.236#53

Non-authoritative answer:
Name:   facebook.com
Address: 157.240.7.35

代理服务器上的 tcpdump 如下所示（客户端 --> 代理 --> DNS）：

[root@warmachine ~]# tcpdump -n -i any host 192.168.180.81 or host 64.104.128.236
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
00:15:51.643536 IP 192.168.180.81.44537 > 192.168.180.100.domain: 49291+ A? facebook.com. (30)
00:15:51.646761 IP 10.106.179.30.rbr-discovery > 64.104.128.236.domain: 33001+% [1au] A? facebook.com. (41)
00:15:51.651612 IP 64.104.128.236.domain > 10.106.179.30.rbr-discovery: 33001- 1/2/4 A 157.240.7.35 (152)
00:15:51.652572 IP 192.168.180.100.domain > 192.168.180.81.44537: 49291 ServFail 0/0/0 (30)
00:15:51.653823 IP 192.168.180.81.43489 > 192.168.180.100.domain: 11362+ A? facebook.com. (30)
00:15:51.654216 IP 10.106.179.30.56534 > 64.104.128.236.domain: 14438+% [1au] A? facebook.com. (41)
00:15:51.659101 IP 64.104.128.236.domain > 10.106.179.30.56534: 14438- 1/2/4 A 157.240.7.35 (152)
00:15:51.659686 IP 192.168.180.100.domain > 192.168.180.81.43489: 11362 ServFail 0/0/0 (30)

我是不是用错误的方法处理这个问题？

答案1

所以这原来是 DNSSEC 问题。更新了以下配置，/etc/named.conf现在一切正常

dnssec-enable no;
dnssec-validation no;

相关内容