OpenDNS에 대한 단순 전달자로 작동 할 수있는 단순 바인드 서버를 설정하고 싶습니다. 서버.
바인드를 원하지는 않지만 루트 서버를 쿼리 할 수 있기 때문에 모든 트래픽이 OpenDNS로만 이동하고 “캐시”역할을 할 수 있습니다.
어떻게 할 수 있습니까? 루트 서버 힌트를 어떤 식 으로든 비활성화해야합니까? 이것이 올바른 절차입니까?
named.conf.default-zones 파일. 재귀를 비활성화하여 비 쿼리 루트 서버도 달성 할 수 있지만 재귀를 비활성화하면 서버도 포워더를 이용할 수 없게되는 것 같습니다. 내 conf가 잘못된 곳은 어디입니까?
Conf는 다음과 같습니다.
named.conf
// This is the primary configuration file for the BIND DNS server named. // // Please read /usr/share/doc/bind9/README.Debian.gz for information on the // structure of BIND configuration files in Debian, *BEFORE* you customize // this configuration file. // // If you are just adding zones, please do that in /etc/bind/named.conf.local include "/etc/bind/named.conf.options"; include "/etc/bind/named.conf.local"; include "/etc/bind/named.conf.default-zones"; named.conf.options
acl "trusted" { 127.0.0.1/8; 10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16; ::1; }; options { directory "/var/cache/bind"; # bind cache directory recursion no; # enables resursive queries allow-query { trusted; } ; allow-recursion { "none"; }; additional-from-cache no; allow-transfer { none; }; # disable zone transfers by default // If there is a firewall between you and nameservers you want // to talk to, you may need to fix the firewall to allow multiple // ports to talk. See http://www.kb.cert.org/vuls/id/800113 // If your ISP provided one or more IP addresses for stable // nameservers, you probably want to use them as forwarders. // Uncomment the following block, and insert the addresses replacing // the all-0"s placeholder. forward only; forwarders { 208.67.222.222; 208.67.220.220; }; //======================================================================== // If BIND logs error messages about the root key being expired, // you will need to update your keys. See https://www.isc.org/bind-keys //======================================================================== dnssec-enable no; dnssec-validation no; dnssec-lookaside auto; auth-nxdomain no; # conform to RFC1035 }; named.conf.local
// // Do any local configuration here // // Consider adding the 1918 zones here, if they are not used in your // organization //include "/etc/bind/zones.rfc1918"; named.conf.default-zones
// prime the server with knowledge of the root servers zone "." { type hint; file "/etc/bind/db.root"; }; // be authoritative for the localhost forward and reverse zones, and for // broadcast zones as per RFC 1912 zone "localhost" { type master; file "/etc/bind/db.local"; }; zone "127.in-addr.arpa" { type master; file "/etc/bind/db.127"; }; zone "0.in-addr.arpa" { type master; file "/etc/bind/db.0"; }; zone "255.in-addr.arpa" { type master; file "/etc/bind/db.255"; };