BIND a kan VPN: tura ta sharadi ko yankin stub?

Resolver ɗin ofishinku yana amsa komai sai wani yanki na suna na kamfani, kuma uwar garken DNS na kamfanin da ya san shi yana bayan VPN. BIND na iya miƙa wannan yanki ɗaya ga upstream ta hanyoyi uku daban-daban, kuma suna kasawa daban. Tura ta sharadi shine ƙaramin alkawari, yankin stub yana riƙe bayanan wakilci, kuma secondary yana riƙe cikakken kwafi. Zaɓi bisa abin da upstream zai yarda da abin da kuke so resolver ɗinku ya riƙe, ba bisa wane guntun da kuka fara samu ba.

Shirye-shirye uku don yanki ɗaya na suna

Tura ta sharadi: ƙaramin alkawari

A ce resolver ɗin ofishi yana 192.168.10.53 kuma uwar garken kamfani yana 10.40.0.53 wanda ake iya kaiwa ta hanyar tunnel da aka amince. Bayanin layi uku ne, kuma mai ban sha'awa shine forward only, domin yana canza halin kasawa ba hanya ba.

zone "corp.example" {
    type forward;
    forward only;
    forwarders { 10.40.0.53; };
};

Tare da forward only, upstream da ba a iya kaiwa yana haifar da SERVFAIL ga wannan yanki maimakon komawa ga warwarewar maimaitawa. Wannan shine yawanci abin da kuke so ga yanki na sirri, domin komawar zai tura sunaye na sirri ga resolver na jama'a kuma ya dawo da amsa marar amfani daga intanet. Bayanan BIND yana rubuta duka manufofin biyu, kuma bambancin ya fi yadda guntun ya nuna muhimmanci. Haɗa yankin cikin tsarin da ake da shi maimakon maye gurbin yankin da ya riga ya wanzu don wannan suna.

Stub ko secondary: lokacin da wakilci ke da muhimmanci

Yankin stub yana tambayar uwar garken kamfani rubutun NS na yankin sannan yana tambayar uwar garken da ke da iko kai tsaye. Zaɓe shi lokacin da yankin upstream yake babba ko rarrabuwa kuma kuna son resolver ɗinku ya bi wakilci maimakon ɗaure komai ga adireshi ɗaya. Kudin shine dogaro ga bayanan NS su kasance na yanzu, da kuma cewa kowace uwar garken suna da aka jera ana iya kaiwa daga adireshin tushen resolver ɗinku.

zone "corp.example" {
    type stub;
    masters { 10.40.0.53; };
};

zone "corp.example" {
    type secondary;
    primaries { 10.40.0.53; };
    file "corp.example.db";
};

Secondary yana amsa daga bayanan gida kuma yana jure katsewar upstream, kuma wannan shine dalilin yarda da dogaron canja wuri. Yana kuma nufin resolver ɗinku yanzu yana riƙe kwafin yankin da ba nasa ba, don haka hanyar fayil, ACL na canja wuri a kan primary da masu ƙidayar sabuntawa duk sun zama wani ɓangare na fagen aikin ku.

Duba da ke yanke shawara tsakanin su

BIND yana ƙirƙirar tambayarsa ta fita da kansa, don haka tambayar ba ita ce ko kwamfutar tafi-da-gidanka za ta iya kaiwa 10.40.0.53 ba, amma ko mai karɓar resolver zai iya, daga adireshin tushen da uwar garken kamfani zai gani. Tambayi kernel, sannan ka tambayi uwar garken, a wannan tsari.

ip route get 10.40.0.53
named-checkconf
rndc reload corp.example
dig @10.40.0.53 corp.example NS +norecurse
dig @192.168.10.53 portal.corp.example

Yarda da UDP da TCP a kan hanya: amsa da aka yanke tana tilasta TCP, kuma manufar da ke yarda da UDP kawai tana haifar da kasawa lokaci-lokaci da suke kama da asarar fakiti. Bangaren kamfani yana buƙatar ka'idar karɓa ga tushen resolver ɗinku da hanyar dawowa gare ta; wannan tushen na iya zama adireshin da aka yi wa resolver ɗinku turawa ko wanda aka fassara a fili, kuma ba safai ba adireshin tafkin abokin ciniki ne. Idan tambayar NS ta kasa, yankin stub ba zai iya aiki ba ko yaya yankin forward zai kasance.

Tabbatar da amsa, ba tunnel ba

Tambaya ta resolver ɗin ofishi don sunan da ba ku taɓa tambaya ba, kuma duba sashin authority na amsar don ganin ko ya fito daga yankin kamfani. Amsa da aka adana a cache ba ta tabbatar da komai game da hanyar yanzu ba, kuma tambaya mai nasara kai tsaye ga upstream ba ta tabbatar da cewa resolver ɗinku ya zaɓi wannan yankin ba. Maimaita wannan tambayar ta TCP don tabbatar da hanyar ta jure yankewa.

Rike abokan ciniki suna fuskantar resolver ɗin ofishi, kuma rike tabbatarwar DNSSEC a kunne. Buɗaɗɗen burauza da aka saita da resolver mai ɓoyewa mai zaman kansa yana ƙetare wannan shiri gaba ɗaya, kuma kashe tabbatarwa don amsa da ba a zata ba ta zama daidai yana musanya kasawar da ake gani da wadda ba a gani.

Rubuta wanne daga cikin nau'ikan uku kuka zaɓa da kuma dalilin. Mutumin da zai ga yankin ya kasa zai buƙaci wannan jumlar fiye da fayil ɗin tsarin.