![Bind9 拒绝查询](https://linux22.com/image/88323/Bind9%20%E6%8B%92%E7%BB%9D%E6%9F%A5%E8%AF%A2.png)
我创建了一个基于bind9的DNS服务器,仅在转发模式下工作:
这是我的named.conf.options 文件:
#acl goodclients {
# localhost;
# localnets;
#};
options {
directory "/var/cache/bind";
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
recursion yes;
#allow-query { goodclients; };
forwarders {
8.8.8.8;
8.8.4.4;
};
forward only;
//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys. See https://www.isc.org/bind-keys
//========================================================================
dnssec-validation auto;
auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
};
我配置了客户端,一切正常,但出现了如下错误:
May 15 08:54:49 digitalocean named[3294]: client x.x.x.x#8137 (unix.stackexchange.com): query (cache) 'unix.stackexchange.com/A/IN' denied
其中 xxxx 是我的公共 IP 地址。
请注意,DNS 服务器是公共的,我在客户端配置中使用其公共 IP。
我应该忽略错误消息吗?
当我使用 DNS 服务器的公共 IP (yyyy) 挖掘 google.com 时:
dig @y.y.y.y google.com
; <<>> DiG 9.9.5-3ubuntu0.8-Ubuntu <<>> @y.y.y.y google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 28091
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com. IN A
;; Query time: 15 msec
;; SERVER: y.y.y.y#53(y.y.y.y)
;; WHEN: Sun May 15 14:57:56 CEST 2016
;; MSG SIZE rcvd: 39
这很令人困惑。
答案1
它不起作用,因为您已注释掉allow-query
和goodclients
指令。您应该取消注释它们并填充goodclients
BIND 应该回答查询的 IP/网络。
acl goodclients {
localhost;
x.x.x.0/24;
};
options {
...
allow-query { goodclients; };
}
从http://www.zytrax.com/books/dns/ch7/queries.html#allow-query
allowed-query 定义允许向服务器发出查询的 IP 地址的匹配列表。
另请注意,从 BIND 9.4.1-P1 开始,默认行为allow-query
从允许更改为禁止。
答案2
找到了。解决办法是添加:
allow-query {
any;
};
编辑: Rui F Ribeiro 的解决方案有效,但我需要创建一个公共服务器。如果您想避免安全问题,请参阅评论。