☰

Bind9 响应策略区域 (RPZ) 在客户端上不起作用

tag-icon • tag-icon domain-name-system bind
Bind9 响应策略区域 (RPZ) 在客户端上不起作用

在我的单身的DNS 服务器，bind9（版本 9.11.5-P4-5.1），我已经配置了一个响应政策区 (RPZ)阻止某些域名。DNS 服务器的 IP 是192.168.1.5

现在我将把相关部分放到不同的文件和命令的配置中：

在服务器上：

在/etc/bind/named.conf.options

acl trusted {
    localhost; # this server
    192.168.1.0/24; #my net
}

还

// Only allows trusted client to use the service
allow-query { trusted; };

forwarders {
    The IP of the NS1 of IPS#1;
    The IP of the NS2 of IPS#1;
    The IP of the NS1 of IPS#2;
    The IP of the NS2 of IPS#2;
    8.8.8.8;
    8.8.4.4;
    1.1.1.1;
};

并且

    // For Ad-Blocking/Blacklisting/Whitelisting
    response-policy {
        zone "rpz.blacklist";
        zone "office.local" policy passthru;
        zone "1.168.192.in-addr.arpa" policy passthru;
    };

在/etc/bind/named.conf.local

  zone "rpz.blacklist" {
      typemaster;
      file "/etc/bind/zones/rpz.blacklist.db";
      allow-query { trusted; };
      allow-transfer { localhost; };
  };

最后/etc/bind/zones/rpz.blacklist.db

  ; BIND reverse data file for empty rfc1918 zone
  ;
  ; DO NOT EDIT THIS FILE - it is used for multiple zones.
  ; Instead, copy it, edit named.conf, and use that copy.
  ;
  $TTL 86400
  @ IN SOA localhost. root.localhost. (
  1     ; Serial
  604800; Refresh
  86400; Retry
  2419200; expire
  86400); Negative Cache TTL
  ;

  @ IN NS localhost.

  ;.:#====================#:.
  ; Blacklist Domains
  ;.:#====================#:.

  ads2000.hw.net IN A 127.0.0.1

还有更多域，但我仅留下一个作为示例。

命令[命名检查配置] 和 [命名检查配置“rpz.blacklist”/etc/bind/zones/rpz.blacklist.db]返回OK，服务启动成功

现在，如果我从同一台服务器 ping ads2000.hw.net它工作正常

  ping -c 5 ads2000.hw.net
  PING ads2000.hw.net (127.0.0.1) 56(84) bytes of data.
  64 bytes from localhost (127.0.0.1): icmp_seq=1 ttl=64 time=0.037 ms
  64 bytes from localhost (127.0.0.1): icmp_seq=2 ttl=64 time=0.037 ms
  64 bytes from localhost (127.0.0.1): icmp_seq=3 ttl=64 time=0.037 ms
  64 bytes from localhost (127.0.0.1): icmp_seq=4 ttl=64 time=0.201 ms
  64 bytes from localhost (127.0.0.1): icmp_seq=5 ttl=64 time=0.034 ms

  --- ads2000.hw.net ping statistics ---
  5 packets transmitted, 5 received, 0% packet loss, time 105ms
  rtt min/avg/max/mdev = 0.034/0.069/0.201/0.066ms

现在如果我从 Linux 客户端执行此操作，它不是：

  ping -c 5 ads2000.hw.net
  PING ads2000.hw.net (65.8.181.28) 56(84) bytes of data.
    64 bytes from server-65-8-181-28.mia3.r.cloudfront.net (65.8.181.28): icmp_seq=1 ttl=246 time=131 ms
    64 bytes from server-65-8-181-28.mia3.r.cloudfront.net (65.8.181.28): icmp_seq=2 ttl=246 time=131 ms
    64 bytes from server-65-8-181-28.mia3.r.cloudfront.net (65.8.181.28): icmp_seq=3 ttl=246 time=131 ms
    64 bytes from server-65-8-181-28.mia3.r.cloudfront.net (65.8.181.28): icmp_seq=4 ttl=246 time=131 ms
    64 bytes from server-65-8-181-28.mia3.r.cloudfront.net (65.8.181.28): icmp_seq=5 ttl=246 time=131 ms

这是我在那台电脑上的 DNS 设置

  cat /etc/resolv.conf
  ## Generated by NetworkManager
  domain office.local
  search office.local
  nameserver 192.168.1.5
  nameserver 1.1.1.1
  nameserver 8.8.8.8

现在如果我从 Windows 客户端执行此操作，它也不起作用：

  ping ads2000.hw.net
  Ping ads2000.hw.net [65.8.181.28] with 32 bytes of data:
  Response from 65.8.181.28: bytes=32 time=131ms TTL=246
  Response from 65.8.181.28: bytes=32 time=131ms TTL=246
  Response from 65.8.181.28: bytes=32 time=131ms TTL=246
  Response from 65.8.181.28: bytes=32 time=131ms TTL=246
  Ping statistics for 65.8.181.28:
      Packets: sent = 4, received = 4, lost = 0
(0% lost),
  Approximate round trip times in milliseconds:
Minimum = 131ms, Maximum = 131ms, Average = 131ms

这是我在那台电脑上的 DNS 设置

   Ethernet Ethernet Adapter:
      Specific DNS suffix for the connection. . : office.local
      DNS servers. . . . . . . . . . . . . . : 192.168.1.5
                                          1.1.1.1
                                          8.8.8.8

如果我删除服务器“1.1.1.1“ 和 ”8.8.8.8“从客户端来看，它可以工作，但从他们那里我失去了互联网

我究竟做错了什么？

我提前感谢您的帮助。

PS：抱歉我的英文不好

附注2：

他们告诉我不要使用 ping，而要使用 dig。

我从别人对我发表的评论中发现了一些新东西，我在同一个服务器上也失败了使用 dig 时，我不会输入 @localhost，而是输入 @192.168.1.5（这是我的服务器的 IP）

有了 IP

dig @192.168.1.5 ads2000.hw.net

; <<>> DiG 9.11.5-P4-5.1+deb10u2-Debian <<>> @192.168.1.5 ads2000.hw.net
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

使用本地主机

dig @localhost ads2000.hw.net

; <<>> DiG 9.11.5-P4-5.1+deb10u2-Debian <<>> @localhost ads2000.hw.net
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21521
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 2ce3f4f1d313ffad11763e9a623e3a8023aa719aef8f2ec4 (good)
;; QUESTION SECTION:
;ads2000.hw.net.                        IN      A

;; ANSWER SECTION:
ads2000.hw.net.         5       IN      A       127.0.0.1

;; Query time: 433 msec
;; SERVER: :127.0.0.1#53(127.0.0.1)
;; WHEN: vie mar 25 18:56:16 -03 2022
;; MSG SIZE  rcvd: 87

相关内容