我想设置一个简单的绑定服务器,能够充当 OpenDNS 服务器的简单转发器。
我不希望我的绑定能够查询根服务器,我希望所有流量仅流向 OpenDNS,并且可能充当它的“缓存”。
如何实现这一目标?我应该以某种方式禁用根服务器提示吗?这是正确的程序吗?
我的猜测是注释掉区域“。”由根服务器提供服务命名.conf.默认区域文件。然而,我读到非查询根服务器也可以通过禁用递归来实现,但禁用递归似乎会导致服务器也无法利用转发器。我的conf哪里错了?
会议内容如下:
命名配置文件
// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
命名.conf.选项
acl "trusted" {
127.0.0.1/8;
10.0.0.0/8;
172.16.0.0/12;
192.168.0.0/16;
::1;
};
options {
directory "/var/cache/bind"; # bind cache directory
recursion no; # enables resursive queries
allow-query { trusted; } ;
allow-recursion { "none"; };
additional-from-cache no;
allow-transfer { none; }; # disable zone transfers by default
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
forward only;
forwarders {
208.67.222.222;
208.67.220.220;
};
//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys. See https://www.isc.org/bind-keys
//========================================================================
dnssec-enable no;
dnssec-validation no;
dnssec-lookaside auto;
auth-nxdomain no; # conform to RFC1035
};
命名.conf.local
//
// Do any local configuration here
//
// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";
命名.conf.默认区域
// prime the server with knowledge of the root servers
zone "." {
type hint;
file "/etc/bind/db.root";
};
// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912
zone "localhost" {
type master;
file "/etc/bind/db.local";
};
zone "127.in-addr.arpa" {
type master;
file "/etc/bind/db.127";
};
zone "0.in-addr.arpa" {
type master;
file "/etc/bind/db.0";
};
zone "255.in-addr.arpa" {
type master;
file "/etc/bind/db.255";
};
答案1
BIND 配置确实会在定义转发器时将本地 BIND 未满足的所有请求发送到转发器。
更重要的是,当forward only;
使用时,本地区域将被忽略,并且所有请求仅由缓存或转发器满足。
如果您需要拥有本地区域(即来自 RFC 1918 的私有 IP 地址和本地家庭/办公室区域),为了拥有转发器,您需要使用根提示和指令来注释该区域forward only;
。
// forward only;
// zone "." {
// type hint;
// file "/etc/bind/db.root";
// };
来自DNS 操作方法
但如果设置了“仅转发”,则 BIND 在未收到转发器的响应时放弃,并且 gethostbyname() 立即返回。因此,无需对 /etc 中的文件进行花招并重新启动服务器。
就我而言,我只是添加了几行
只向前;货运代理{193.133.58.5; };
到我的named.conf 文件的options { } 部分。它工作得非常好。这样做的唯一缺点是,它将极其复杂的 DNS 软件降低到哑缓存的状态。
所以,如果你只需要一个哑缓存,你可以只转发请求。例如,当您将请求转发到中央办公室时,这是公司环境中的适当配置。
根据您的情况,当您向外部转发请求时,我建议不要盲目这样做,forward only
以免将私有 IP 地址范围/本地 DNS/Windows 域的 DNS 请求转发到更高层次结构/根名称服务器。