![BIND DNS 将客户端限制到某些域](https://linux22.com/image/753784/BIND%20DNS%20%E5%B0%86%E5%AE%A2%E6%88%B7%E7%AB%AF%E9%99%90%E5%88%B6%E5%88%B0%E6%9F%90%E4%BA%9B%E5%9F%9F.png)
我正在运行一个 BIND DNS 服务器,该服务器有 1 个权威区域 (abc.com) 和 2 个转发内部区域 (rst.com 和 xyz.com)。该服务器还充当互联网缓存服务器。
我的要求是根据子网将客户端限制到某些域。
- 子网 A(192.168.1.0/24)只能解析权威和转发的内部区域,而不能解析互联网。
- 其他子网可以解析 Internet + 加转发区域,但不能解析权威区域。
我已经配置了以下named.conf文件,第二条规则运行正常,但第一条规则不适用于任何域。服务器在chroot环境中运行,如果有人发现配置中的任何错误,请突出显示
options {
listen-on port 53 { any; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query { any; };
allow-query-cache { any; };
recursion yes;
dnssec-enable yes;
dnssec-validation no;
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
include "/etc/crypto-policies/back-ends/bind.config";
forwarders {
8.8.8.8;
};
forward only;
};
view "internal" {
match-clients { 192.168.1.100/32; };
recursion yes;
zone "." IN {
type hint;
file "named.ca";
};
zone "abc.com" IN {
type master;
file "abc.com";
};
zone "rst.com" IN {
type forward;
forward only;
forwarders { 192.168.20.10; 192.168.20.20; };
};
zone "xyz.com" IN {
type forward;
forward only;
forwarders { 192.168.10.10; 192.168.10.20; };
};
include "/etc/named.rfc1912.zones";
};
view "other" {
match-clients { any; };
zone "." IN {
type hint;
file "named.ca";
};
zone "rst.com" IN {
type forward;
forward only;
forwarders { 192.168.20.10; 192.168.20.20; };
};
zone "xyz.com" IN {
type forward;
forward only;
forwarders { 192.168.10.10; 192.168.10.20; };
};
include "/etc/named.rfc1912.zones";
};