домен для примера xxx.ru
зарегили ns1.xxx.ru 212.3.135.192 и ns2.xxx.ru 212.3.145.133
// **** named.conf
Код: Выделить всё
options
{
// Put files that named is allowed to write in the data/ directory:
directory "/var/named"; // "Working" directory
dump-file "data/cache_dump.db";
statistics-file "data/named_stats.txt";
memstatistics-file "data/named_mem_stats.txt";
/*
Specify listenning interfaces. You can use list of addresses (';' is
delimiter) or keywords "any"/"none"
*/
listen-on port 53 { any; };
allow-query { any; };
allow-query-cache { localhost; 192.168.5.0/24; };
allow-transfer { localhost; 192.168.5.0/24; };
// Enable/disable recursion - recursion yes/no;
recursion yes;
/* DNSSEC related options. See information about keys ("Trusted keys", bellow) */
/* Enable serving of DNSSEC related data - enable on both authoritative
and recursive servers DNSSEC aware servers */
dnssec-enable no;
/* Enable DNSSEC validation on recursive servers */
dnssec-validation no;
};
logging
{
/* If you want to enable debugging, eg. using the 'rndc trace' command,
* named will try to write the 'named.run' file in the $directory (/var/named).
* By default, SELinux policy does not allow named to modify the /var/named directory,
* so put the default debug log file in data/ :
*/
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
/*
Views let a name server answer a DNS query differently depending on who is asking.
By default, if named.conf contains no "view" clauses, all zones are in the
"default" view, which matches all clients.
Views are processed sequentially. The first match is used so the last view should
match "any" - it's fallback and the most restricted view.
If named.conf contains any "view" clause, then all zones MUST be in a view.
*/
view "localhost_resolver"
{
/* This view sets up named to be a localhost resolver ( caching only nameserver ).
* If all you want is a caching-only nameserver, then you need only define this view:
*/
match-clients { localhost; };
recursion yes;
allow-query { any; };
# all views must contain the root hints zone:
zone "." IN {
type hint;
file "/var/named/named.ca";
};
zone "xxx.ru" {
type master;
file "xxx.ru";
allow-query { any; };
allow-update { any; };
allow-transfer { any; };
};
/* these are zones that contain definitions for all the localhost
* names and addresses, as recommended in RFC1912 - these names should
* not leak to the other nameservers:
*/
};
view "internal"
{
/* This view will contain zones you want to serve only to "internal" clients
that connect via your directly attached LAN interfaces - "localnets" .
*/
match-clients { localnets; 192.168.5.0/24; };
recursion yes;
zone "." IN {
type hint;
file "/var/named/named.ca";
};
/* these are zones that contain definitions for all the localhost
* names and addresses, as recommended in RFC1912 - these names should
* not leak to the other nameservers:
*/
// These are your "authoritative" internal zones, and would probably
// also be included in the "localhost_resolver" view above :
/*
NOTE for dynamic DNS zones and secondary zones:
DO NOT USE SAME FILES IN MULTIPLE VIEWS!
If you are using views and DDNS/secondary zones it is strongly
recommended to read FAQ on ISC site (www.isc.org), section
"Configuration and Setup Questions", questions
"How do I share a dynamic zone between multiple views?" and
"How can I make a server a slave for both an internal and an external
view at the same time?"
*/
zone "xxx.ru" {
type master;
file "xxx.ru";
allow-query { any; };
allow-update { any; };
allow-transfer { any; };
};
include "/etc/named.rfc1912.zones";
view "external"
{
/* This view will contain zones you want to serve only to "external" clients
* that have addresses that are not match any above view:
*/
match-clients { any; };
allow-query { any; };
allow-query-cache { any; };
allow-transfer { any; };
zone "." IN {
type hint;
file "/var/named/named.ca";
};
recursion yes;
// you'd probably want to deny recursion to external clients, so you don't
// end up providing free DNS service to all takers
// These are your "authoritative" external zones, and would probably
// contain entries for just your web and mail servers:
zone "xxx.ru" {
type master;
file "xxx.ru";
allow-query { any; };
allow-update { any; };
allow-transfer { any; };
};
};Собственно сам файл зоны:
//**** xxx.ru
Код: Выделить всё
$TTL 86400
$ORIGIN RU.
XXX 86400 IN SOA ns1.xxx.ru. admin.xxx.ru (
1187311 ;Serial
10800 ;Refresh
3600 ;Retry
604800 ;Expire
10800 ) ;Minimum
$ORIGIN XXX.RU.
@ NS ns1.xxx.ru.
NS ns2.ixxx.ru.
ns1.xxx.ru. A 212.3.135.192
ns2.xxx.ru. A 212.3.145.133
xxx.ru. A 212.3.135.192
www A 212.3.135.192Порт DNS-а (53) вроде не заблочен, на slave сервер (212.3.145.133) зона передается, внутри локалки 192.168.5.0/24 адрес ресолвится, а вот из живого инета ваще никак. этот домен не виден, не пингуется и при nslookup -> server 212.3.135.192 никак на реагирует, изнутри локалки вроде всё. Ок.
Вот не пойму механику процесса как происходит запрос от того когда клиент инета набирает ping www.xxx.ru до ответа моего DNS-а?!