bind9 bind-9.17.2
已从源代码编译Debian-9。
./named -V
BIND 9.17.2 (Development Release) <id:6d46544>
running on Linux x86_64 4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07)
built by make with '--with-maxminddb' '--prefix=/usr' '--enable-fixed-rrset' '--sysconfdir=/etc/bind'
compiled by GCC 6.3.0 20170516
compiled with OpenSSL version: OpenSSL 1.1.0l 10 Sep 2019
linked to OpenSSL version: OpenSSL 1.1.0l 10 Sep 2019
compiled with zlib version: 1.2.8
linked to zlib version: 1.2.8
linked to maxminddb version: 1.2.0
threads support is enabled
default paths:
named configuration: /etc/bind/named.conf
rndc configuration: /etc/bind/rndc.conf
DNSSEC root key: /etc/bind/bind.keys
nsupdate session key: /usr/var/run/named/session.key
named PID file: /usr/var/run/named/named.pid
named lock file: /usr/var/run/named/named.lock
geoip-directory: /usr/share/GeoIP
主要目标是利用其地理IP功能并根据解析器 IP 地址位置回答查询,其配置named.conf.local
非常简单:
...
...
include "/etc/bind/geoip/GeoIP.acl";
view "Iran" {
match-clients { IR; };
recursion no;
zone "ppod.ir" {
type master;
file "/etc/bind/db.ppod.ir.iran";
};
};
view "default" {
include "/etc/bind/named.conf.default-zones";
...
...
区域为db.ppod.ir.iran
:
; A, AAAA => host record
ppod.ir. 1 IN A 185.8.172.233
并且对于default view
是:
; A, AAAA => host record
ppod.ir. 1 IN A 5.63.13.22
ppod.ir. 1 IN A 95.216.12.6
现在如果我查询域名点播来自伊朗,DNS服务器给了我错误的IP。
$ dig ppod.ir # the answer is wrong
; <<>> DiG 9.11.3-1ubuntu1.12-Ubuntu <<>> ppod.ir
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15519
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;ppod.ir. IN A
;; ANSWER SECTION:
ppod.ir. 1 IN A 5.63.13.22
ppod.ir. 1 IN A 95.216.12.6
;; Query time: 263 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Tue Jul 14 12:59:53 +0430 2020
;; MSG SIZE rcvd: 68
但无论哪种方式,如果我直接询问 DNS 服务器或跟踪查询,它都会给出正确的 IP。
$ dig ppod.ir @171.22.25.82 +short # the answer is right
185.8.172.233
并追踪它:
$ dig ppod.ir @1.1.1.1 +trace +short # the answer is right
NS a.root-servers.net. from server 1.1.1.1 in 257 ms.
NS b.root-servers.net. from server 1.1.1.1 in 257 ms.
NS c.root-servers.net. from server 1.1.1.1 in 257 ms.
NS d.root-servers.net. from server 1.1.1.1 in 257 ms.
NS e.root-servers.net. from server 1.1.1.1 in 257 ms.
NS f.root-servers.net. from server 1.1.1.1 in 257 ms.
NS g.root-servers.net. from server 1.1.1.1 in 257 ms.
NS h.root-servers.net. from server 1.1.1.1 in 257 ms.
NS i.root-servers.net. from server 1.1.1.1 in 257 ms.
NS j.root-servers.net. from server 1.1.1.1 in 257 ms.
NS k.root-servers.net. from server 1.1.1.1 in 257 ms.
NS l.root-servers.net. from server 1.1.1.1 in 257 ms.
NS m.root-servers.net. from server 1.1.1.1 in 257 ms.
RRSIG NS 8 0 ..... from server 1.1.1.1 in 257 ms.
couldn't get address for 'ns2.redcursor.ir': not found
A 185.8.172.233 from server 171.22.25.82 in 40 ms.
TTL 的缓存已设置为 1,并且绑定已符合 GeoIP 功能,问题是为什么 DNS 服务器没有正确响应? 我知道缓存 IP 地址和公共 DNS 服务器的递归查询,但根据我的配置,IP 应该被缓存
这是这两个查询的日志dig ppod.ir
,dig ppod.ir @171.22.25.82
来自相同的位置和 IP 地址。第一个是错误的,第二个是正确的。
14-Jul-2020 08:38:21.312 info: client @0x7fbb20000a30 162.158.82.125#56703 (ppod.ir): view default: query: ppod.ir IN A -E(0)D (171.22.25.82)
14-Jul-2020 08:38:21.312 debug 3: client @0x7fbb20000a30 162.158.82.125#56703 (ppod.ir): view default: query 'ppod.ir/A/IN' approved
14-Jul-2020 08:38:21.312 debug 3: client @0x7fbb20000a30 162.158.82.125#56703 (ppod.ir): view default: reset client
14-Jul-2020 08:38:43.308 debug 3: client @0x7fbb20000a30 5.117.5.210#55509: UDP request
14-Jul-2020 08:38:43.308 debug 5: client @0x7fbb20000a30 5.117.5.210#55509: view Iran: using view 'Iran'
14-Jul-2020 08:38:43.308 debug 3: client @0x7fbb20000a30 5.117.5.210#55509: view Iran: request is not signed
14-Jul-2020 08:38:43.308 debug 3: client @0x7fbb20000a30 5.117.5.210#55509: view Iran: recursion not available
14-Jul-2020 08:38:43.308 info: client @0x7fbb20000a30 5.117.5.210#55509 (ppod.ir): view Iran: query: ppod.ir IN A +E(0)K (171.22.25.82)
14-Jul-2020 08:38:43.308 debug 3: client @0x7fbb20000a30 5.117.5.210#55509 (ppod.ir): view Iran: query 'ppod.ir/A/IN' approved
14-Jul-2020 08:38:43.308 debug 3: client @0x7fbb20000a30 5.117.5.210#55509 (ppod.ir): view Iran: reset client
答案1
感谢@MichaelHampton指出这一事实,我的本地解析器已配置为使用我们网络一侧的 DNS 服务器,而我已设置了 bind9 DNS 服务器。
因此,在未配置我的本地解析器使用systemd-resolver
和启用DHCP
我的调制解调器后,现在来自的查询dig
给出了正确的答案。
dig ppod.ir
; <<>> DiG 9.11.3-1ubuntu1.12-Ubuntu <<>> ppod.ir
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21503
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;ppod.ir. IN A
;; ANSWER SECTION:
ppod.ir. 1 IN A 185.8.172.233
;; Query time: 153 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Sun Jul 19 12:14:46 +0430 2020
;; MSG SIZE rcvd: 52