linux 5.5 64位bind9.3.6辅助DNS，客户端解析出错

bds6011

现有windows2003主DSN服务器一台，ip地址172.16.10.4
新搭linux 5.5 x64 系统搭bind9.3.6 作为辅助DNS服务器，ip地址172.16.10.98   

bind这台已经关闭防火墙、关闭selinux、在bind本机上ping内网的域名、外网的域名均正常出结果，但在以辅助DNS为首选dns的时候，客户端无法解析出公网的域名，内网的正常。下面上代码

[root@Bind etc]# cat /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#       enforcing - SELinux security policy is enforced.
#       permissive - SELinux prints warnings instead of enforcing.
#       disabled - SELinux is fully disabled.
SELINUX=disabled
# SELINUXTYPE= type of policy in use. Possible values are:
#       targeted - Only targeted network daemons are protected.
#       strict - Full SELinux protection.
SELINUXTYPE=targeted


[root@Bind etc]# cat /etc/resolv.conf
nameserver 127.0.0.1
nameserver 172.16.10.98



[root@Bind etc]# service iptables status
Firewall is stopped.


[root@Bind etc]# vi named.conf

//
// named.caching-nameserver.conf
//
// Provided by Red Hat caching-nameserver package to configure the
// ISC BIND named( DNS server as a caching only nameserver
// (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// DO NOT EDIT THIS FILE - use system-config-bind or an editor
// to create named.conf - edits to this file will be lost on
// caching-nameserver package upgrade.
//
options {
        listen-on port 53 { 172.16.10.98; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";

        // Those options should be used carefully because they disable port
        // randomization
        // query-source    port 53;
        // query-source-v6 port 53;

        recursion  yes;
        allow-query     { any; };
        allow-query-cache { localhost; };
};
logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};
view localhost_resolver {
        match-clients      { any; };
        match-destinations { any; };
        allow-transfer   { any; };
        recursion yes;
        include "/etc/named.rfc1912.zones";
};



以下是节选
[root@Bind etc]# vi named.rfc1912.zones



zone "abc.com" IN {
        type slave;
        masters { 172.16.10.4; };
        file "slaves/abc.com.zone";
        // allwo-upte { none; };
};

zone "16.172.in-addr.arpa" IN {
        type slave;
        masters { 172.16.10.4; };
        file "slaves/16.172.arpa";
};

zone "123.com" IN {
        type slave;
        masters { 172.16.10.4; };
        file "slaves/123.com.zone";
};

zone "7.16.172.in-addr.arpa" IN {
        type slave;
        masters { 172.16.10.4; };
        file "slaves/172.16.7.arpa";
};



在客户机上的日志

Jun  7 17:29:02 bind named[23680]: client 172.16.28.230#1393: view localhost_resolver: query (cache) 'www.xmdxkc.com/A/IN' denied

chenyx

allow-query-cache { localhost; };改成 allow-query-cache { any; };测试下

woxizishen

VIEW的設定有問題。O(∩_∩)O~

woxizishen

給你個小提示 設定了view 別忘記那個.