Dotaz: dns-resolving (lokalni subnet)

[kuda]

dobre odpoledne, trapi me jeden velice frustrujici problem .. grrrr

local: 1-192.168.1/24 2-172.32.1/24

na rozsahu 1 bezi bind9(dns-server) a resolvuje v pohode, ale jen pro subnet 1 .... ze subnetu 2 funguje dig a ping na dns-server, ale tento neprelozi "internetovy dotaz" - vsechny acl sem zrusil kvuli testum, stejne bezvysledne ... ostudou (pro me) je, ze na subnetu 1 bezi starej wokenni dns-server, pri prepnuti na nej vse v pohode

predem diky za kopance, neco ze syslogu, jinak vic muzu dodat po nastaveni logovani (na to uz ted ale nemam)

Feb  9 16:30:03 samba1 named[4014]: client 172.32.1.15#47676: query (cache) 'google.com/A/IN' denied
Feb  9 16:30:08 samba1 named[4014]: client 172.32.1.15#58638: query (cache) 'google.com/A/IN' denied

Odpovědi

[hates]

Mate v bindu povolen allow query i pro tu druhou sit, dalsi mate nastaven recursion pro ten subnet. veci muze byt vic. co takhle pastnou konfigurak named.conf

[kuda]

prikladam named configy z local-masteru, diky moc za trpelivost, rekurze pocitam, ze je defaultne zapnuta, distro je ubuntu 8.04 lts, named je chroot ...dig vraci vsechno jak ma, jen ten preklad "ven" z localu 2 pokulhava ..... verze bindu 9.4.2-10

root@samba1:/etc/bind# cat named.conf
// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the 
// structure of BIND configuration files in Debian, *BEFORE* you customize 
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local

include "/etc/bind/named.conf.options";

// prime the server with knowledge of the root servers
zone "." {
	type hint;
	file "/etc/bind/db.root";
};

// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912

zone "localhost" {
	type master;
	file "/etc/bind/db.local";
};

zone "127.in-addr.arpa" {
	type master;
	file "/etc/bind/db.127";
};

zone "0.in-addr.arpa" {
	type master;
	file "/etc/bind/db.0";
};

zone "255.in-addr.arpa" {
	type master;
	file "/etc/bind/db.255";
};

//because of dnssec

key "TRANSFER" {
	algorithm hmac-md5;
	secret "XXXXXXXXXXXXXXXXXXx";
};

server 192.168.1.242 {
	keys {
	TRANSFERS;
	};
};

include "/etc/bind/named.conf.local";

################################################################

root@samba1:/etc/bind# cat named.conf.options 
options {
	directory "/var/cache/bind";

	// If there is a firewall between you and nameservers you want
	// to talk to, you might need to uncomment the query-source
	// directive below.  Previous versions of BIND always asked
	// questions using port 53, but BIND 8.1 and later use an unprivileged
	// port by default.

	// query-source address * port 53;

	// If your ISP provided one or more IP addresses for stable 
	// nameservers, you probably want to use them as forwarders.  
	// Uncomment the following block, and insert the addresses replacing 
	// the all-0's placeholder.

	forwarders {
	 	62.128.242.20;
		62.128.242.18;
	};

	auth-nxdomain no;    # conform to RFC1035
	listen-on-v6 { any; };
	dnssec-enable yes;
};

//acl mynet {
//	192.168.1.0/24;
//	127.0.0.1;
//};

#############################################################################

root@samba1:/etc/bind# cat named.conf.local 
//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

zone "hk.no" {
	type master;
	file "/etc/bind/db.hk.no";
	allow-query {
		mynet;
	};

	allow-transfer {
	key TRANSFER;
	};

	allow-update {
		mynet;
	};
};

zone "hattfjelldal-kommune.no" {
	type master;
	file "/etc/bind/db.hattfjelldal-kommune.no";
	allow-query {
		mynet;
	};

	allow-transfer {
	key TRANSFER;
	};

//	allow-update {
//		mynet;
//	};
};

zone "1.168.192.in-addr.arpa" {
	type master;
	file "/etc/bind/db.192.168.1.rev";
	allow-query {
		mynet;
	};

	allow-transfer {
	key TRANSFER;
	};

	allow-update {
		mynet;
	};
};

zone "1.32.172.in-addr.arpa" {
	type master;
	file "/etc/bind/db.172.32.1.rev";
	allow-query {
		mynet;
	};

	allow-transfer {
	key TRANSFER;
	};
};

acl mynet {
	192.168.1.0/24;
	172.32.1.0/24;
	127.0.0.1;
};

[pupu]

http://support.menandmice.com/jforum/posts/list/25.page ?

[tom]

Nevim, jake verse je ten bind, ale je mozne, ze defaultne povoluje recursivni dotazy jen z localhostu a z rozsahu podle rfc 1918. Problem je, ze ten druhy rozsah je uz mimo 172.16.0.0/12 - ten konci na 172.31.255.255. Takze by resenim mohlo byt bud preadresovat, nebo si nastavit vlastni acl a recursivni dotazy povolit pro nej.

Tomas

[pupu]

Nojo, pravda. Pouzivat verejnou adresu v intranetu opravdu neni dobry napad - pripojuji se s doporucenim preadresovat.

[Zdeněk Štěpánek]

Zdravim

Od jiste doby named nasloucha jen na lokalnich subnetech. Driv odpovidal komukoliv, takze je ted potreba pridat tohle:

allow-query { any; };

Zdenek

[kuda]

diky vsem moc za pomoc, uz je to ok, stacilo v named.conf.options nadefinovat allow recursion pro ty localni subnety, presne jak to uvadi link vyse + jak bylo zmineno hned v prvni reakci na dotaz .. dik a pekny odpoledne vsem!k. p.s...precislovani se castecne podarilo, ale je tu od mych predchudcu nastaven iterni local na 172.32.1/24 urcite v domeni, ze jde o privatni rozsah a tento je svazanej s dost velikym poctem sluzeb, takze to pude jen postupne ..