Dividir DNS (bind9), algum cliente de correspondência não funciona?

Question

Eu tenho lutado com isso nos últimos dias. Algumas das minhas entradas têm IP externos e internos. Minha rede interna é 10.0.0.0/8.

Quando eu nslookup pc1.clase.net internamente, ele responde com um endereço 10.0.0.0, mas se eu nslookup pc1.clase.net externamente, ele ainda me fornece um endereço 10.0.0.0.

Estou no Debian Wheezy.

named.conf

include "/etc/bind/named.conf.options";
view "internal" {
  match-clients { 10.0.0.0/8;};
  zone "clase.net"{
    type master;
    file "/etc/bind/internals/db.forward.net";
    allow-transfer { 10.0.0.11/8; }
  };
};
include "/etc/bind/named.conf.default-zones";

zone "10.in-addr.arpa" {
  type master;
  file "/etc/bind/internals/db.reverse.net";
  allow-transfer { 10.0.0.11/8;
  };
};
};

view "external" {
  match-clients { any; };
  zone "clase.net" {
    type master;
    file "/etc/bind/externals/db.forward.net";
    allow-transfer { 10.0.0.11/18;
    };
  };
};

interno / db.foward.net

$TTL    604800
@       IN      SOA     ns.clase.net. root.clase.net. (
                     2 ; Serial
                         604800 ; Refresh
                          86400 ; Retry
                        2419200 ; Expire
                         604800); Negative Cache TTL
;
@   IN  NS  ns.clase.net.
ns  IN  A   10.0.0.10
pc1 IN  A   10.0.0.12

external / db.forward.net

$TTL    604800
@       IN      SOA     ns.clase.net. root.clase.net. (
                     2 ; Serial
                         604800 ; Refresh
                          86400 ; Retry
                        2419200 ; Expire
                         604800); Negative Cache TTL
;
@   IN  NS  ns
    IN  A   150.210.0.1
ns  IN  A   150.210.0.1
pc1 IN  A   150.210.0.22

    

Answer 1

Não tenho certeza se esse é o seu problema, mas ao analisar seu arquivo de configuração, parece que você tem alguns erros de digitação.

Exemplo

Este bloco parece ter muitas chaves de fechamento ( }; ).

zone "10.in-addr.arpa" {
  type master;
  file "/etc/bind/internals/db.reverse.net";
  allow-transfer { 10.0.0.11/8;
  };
};
};

Deve ser isso, não?

zone "10.in-addr.arpa" {
  type master;
  file "/etc/bind/internals/db.reverse.net";
  allow-transfer { 10.0.0.11/8; }
};

Versão limpa do seu arquivo named.conf .

include "/etc/bind/named.conf.options";
view "internal" {
  match-clients { 10.0.0.10/24;};
  zone "clase.net" {
    type master;
    file "/etc/bind/internals/db.forward.net";
    allow-transfer { 10.0.0.11/8; };
  };
};

include "/etc/bind/named.conf.default-zones";

zone "10.in-addr.arpa" {
  type master;
  file "/etc/bind/internals/db.reverse.net";
  allow-transfer { 10.0.0.11/8; };
};

view "external" {
  match-clients { any; };
  zone "clase.net" {
    type master;
    file "/etc/bind/externals/db.forward.net";
    allow-transfer { 10.0.0.11/18; };
  };
};

rede errada do cliente?

Estas linhas parecem incorretas para mim:

view "internal" {
  match-clients { 10.0.0.0/8;};
  zone "clase.net"{
    type master;
    file "/etc/bind/internals/db.forward.net";
    allow-transfer { 10.0.0.11/8; }
  };
};

Deve ser isso, não?

view "internal" {
  match-clients { 10.0.0.0/8;};
  zone "clase.net"{
    type master;
    file "/etc/bind/internals/db.forward.net";
    allow-transfer { 10.0.0.0/8; }
  };
};

Referências

• BIND 9 Configurar exibições para particionar informações de DNS externas e internas

Answer 2

Finalmente descobri como fazer isso.

Requer que as chaves TSIG diferenciem as duas zonas.

    

Answer 3

-Aqui dê uma olhada !!!

named.conf

// If you are just adding zones, please do that in /etc/bind/named.conf.local

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
include "/etc/bind/t-sig.key";

named.conf.options

acl internals {
                127.0.0.0/8;
                10.0.0.0/8;
              };

options {

    directory "/var/cache/bind";

    allow-recursion     { internals; };
    allow-query-cache   { internals; };
    allow-query         { internals; };

    dnssec-enable     yes;
    dnssec-validation yes;

     forwarders {

        // -Google - JUST FOR SAMPLE!!!
        8.8.4.4;
        8.8.8.8;

    };

    auth-nxdomain no;    # conform to RFC1035
    listen-on-v6 { any; };
};

named.conf.local

include "/etc/bind/zones.rfc1918";

acl internals {
    127.0.0.0/8;
};

    zone "localhost" { 
        type master; 
        file "/etc/bind/db.local";
     };

};

named.conf.default-zones

// prime the server with knowledge of the root servers

    zone "." {
        type hint;
        file "/etc/bind/db.root";
    };

// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912

    zone "sample.net" {
        type master;
        file "/etc/bind/db.sample.net";
        allow-query     { internals; };
        allow-transfer  { key t-sig.key; };  
    };

    zone "localhost" {
        type master;
        file "/etc/bind/db.local";
        allow-query { 127.0.0.0/8; };
        allow-transfer  { key t-sig.key; };
    };

    zone "127.in-addr.arpa" {
        type master;
        file "/etc/bind/127.in-addr.arpa";
        allow-query { 127.0.0.0/8; };
        allow-transfer  { key t-sig.key; };
    };

    zone "10.in-addr.arpa" {
        type master;
        file "/etc/bind/0.0.10.in-addr.arpa";
        allow-query { internals; };
        allow-transfer  { key t-sig.key; };
    };

    zone "0.in-addr.arpa" {
        type master;
        file "/etc/bind/0.in-addr.arpa";
        allow-query { internals; };
    };

    zone "255.in-addr.arpa" {
        type master;
        file "/etc/bind/255.in-addr.arpa";
        allow-query { internals; };
    };