I-BIND phezu kwe-VPN: ukudlulisa okunemibandela noma indawo ye-stub?

Izindlela ezintathu zokuxazulula indawo eyodwa yangasese nge-VPN, nokuthi iyiphi ifanele nini: forward, stub noma secondary, kanye nokuhlolwa kwekheli lomthombo okunqumayo.

I-resolver yasehhovisi lakho iphendula konke ngaphandle kwendawo eyodwa yamagama yebhizinisi, futhi iseva ye-DNS yebhizinisi eyaziyo ingemuva kwe-VPN. I-BIND inganikeza leyo ndawo eyodwa ku-upstream ngezindlela ezintathu ezihlukene, futhi zihluleka ngendlela ehlukene. Ukudlulisa okunemibandela yisibopho esincane kunazo zonke, indawo ye-stub igcina idatha yokudluliselwa, futhi i-secondary igcina ikhophi ephelele. Khetha ngokusho kwalokho okuvunyelwa yi-upstream nokusho kwalokho ofuna i-resolver yakho ikugcine, hhayi ngokusho kwalokho okutholile kuqala.

Izinhlelo ezintathu zendawo eyodwa yamagama

TypeWhat your resolver keepsUpstream mustFails when
forwarda forwarder listanswer queries from your source addressupstream is down and forward only is set
stubthe zone's NS records and addressesanswer NS queries for the zonedelegation data goes stale after an NS change
secondarya full copy of the zonepermit AXFR or IXFR from your sourcetransfer is blocked by ACL or firewall

Ukudlulisa okunemibandela: isibopho esincane kunazo zonke

Ake sithi i-resolver yasehhovisi iku-192.168.10.53 futhi iseva yebhizinisi iku-10.40.0.53 efinyeleleka ngomhubhe ogunyaziwe. Isimemezelo simigqa emithathu, futhi esithakazelisayo yi-forward only, ngoba sishintsha ukuziphatha lapho kuhluleka, hhayi indlela.

zone "corp.example" {
    type forward;
    forward only;
    forwarders { 10.40.0.53; };
};

Nge-forward only, i-upstream engafinyeleleki ikhipha i-SERVFAIL yale ndawo esikhundleni sokubuyela ekuxazululeni okuphindaphindiwe. Lokhu ngokuvamile yikho okufunayo endaweni yangasese yamagama, ngoba ukubuyela bekuzothumela amagama angasese ku-resolver yomphakathi bese kubuyisa impendulo engenasisekelo evela ku-inthanethi. Incwadi yesethenjwa ye-BIND ibhala zombili izinqubomgomo, futhi umehluko ubaluleka ngaphezu kwalokho okusikisela isiqeshana. Hlanganisa indawo ekucushweni okukhona esikhundleni sokushintsha indawo evele ikhona ngalelo gama.

I-stub noma i-secondary: lapho ukudluliselwa kubalulekile

Indawo ye-stub ibuza iseva yebhizinisi amarekhodi e-NS endeawo, bese icela ngqo kumaseva anegunya. Yikhethe lapho isifunda se-upstream sikhulu noma sihlukanisiwe futhi ufuna i-resolver yakho ilandele ukudluliselwa esikhundleni sokubophela konke kukheli elilodwa. Intengo ukuncika ekutheni idatha ye-NS isesikhathini, nasekutheni wonke umseva wamagama ohlisiwe ufinyeleleka esuka kukheli lomthombo lwe-resolver yakho.

zone "corp.example" {
    type stub;
    masters { 10.40.0.53; };
};

zone "corp.example" {
    type secondary;
    primaries { 10.40.0.53; };
    file "corp.example.db";
};

I-secondary iphendula isuka kudatha yasendaweni futhi ikwazi ukumelana nokuphazamiseka kwe-upstream, futhi yisona sizathu sokwamukela ukuncika kokudluliswa. Kusho futhi ukuthi i-resolver yakho manje igcina ikhophi yendawo engeyona eyayo, ngakho indlela yefayela, i-ACL yokudluliswa kuseva eyisisekelo kanye nezikhathi zokuvuselela konke kuba yingxenye yendawo yakho yokusebenza.

Ukuhlolwa okunquma phakathi kwazo

I-BIND izakhela umbuzo wayo wokuphuma, ngakho umbuzo akukhona ukuthi ikhompyutha ephathwayo ingafinyelela ku-10.40.0.53 kodwa ukuthi umsingathi we-resolver angafinyelela yini, esuka kukheli lomthombo ozobonwa iseva yebhizinisi. Buza i-kernel, bese ubuza iseva, ngalolo hlelo.

ip route get 10.40.0.53
named-checkconf
rndc reload corp.example
dig @10.40.0.53 corp.example NS +norecurse
dig @192.168.10.53 portal.corp.example

Vumela i-UDP ne-TCP endleleni: impendulo enqunyiwe iphoqa i-TCP, futhi inqubomgomo evumela i-UDP kuphela ikhipha ukwehluleka ngezikhathi ezithile okubonakala njengokulahleka kwamaphakethe. Uhlangothi lwebhizinisi ludinga kokubili umthetho wokwamukela umthombo we-resolver yakho kanye nomzila wokubuya kuwona; lowo mthombo ungaba ikheli eliqondisiwe le-resolver noma elihunyushwe ngokucacile, futhi akuvamisile ukuba yikheli leqembu lamaklayenti. Uma umbuzo we-NS uhluleka, indawo ye-stub ayikwazi ukusebenza, kungakhathaliseki ukuthi indawo ye-forward yenza kanjani.

Qinisekisa impendulo, hhayi umhubhe

Buza nge-resolver yasehhovisi igama ongakaze ulibuze, bese ubheka isigaba se-authority sempendulo ukuze ubone ukuthi sasuka endaweni yebhizinisi yini. Impendulo esegcinweni ayifakazisi lutho ngomzila wamanje, futhi umbuzo ophumelelayo oqondile ku-upstream awufakazisi ukuthi i-resolver yakho yakhetha leyo ndawo. Phinda lowo mbuzo nge-TCP ukuqinisekisa ukuthi umzila umelana nokunqunywa.

Gcina amaklayenti ebheke ku-resolver yasehhovisi, futhi ugcine ukuqinisekiswa kwe-DNSSEC kuvuliwe. Isiphequluli esilungiselelwe nge-resolver ehlukile ebethelwe sidlula ngokuphelele lolu hlelo, futhi ukuvala ukuqinisekiswa ukuze impendulo engalindelekile ibonakale ilungile kushintsha ukwehluleka okubonakalayo kube okungabonakali.

Bhala ukuthi yiluphi uhlobo kwezintathu olukhethile nokuthi kungani. Umuntu olandelayo ozobona indawo ihluleka uzodinga lowo musho ngaphezu kwefayela lokucushwa.

Izihloko ezihlobene