Приветствую!
Настраиваю BIND первый раз.
Прошерстил много разных статей, в итоге получил такую конфигурацию:
cat /etc/bind/named.conf
// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local
logging {
channel "misc" {file "/var/log/named/misc.log" versions 4 size 4m; print-time YES; print-severity YES; print-category YES;};
channel "query" {file "/var/log/named/query.log" versions 4 size 4m; print-time YES; print-severity NO; print-category NO;};
category default {"misc";};
category queries {"query";};
};
include "/etc/bind/nets";
include "/etc/bind/named.conf.options";
//include "/etc/bind/named.conf.default-zones";
key rndc-key {
algorithm hmac-md5;
secret "f/9/lFMgopWW8PKQcSyXEQ==";
};
controls {
inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { rndc-key; };
};
server 172.23.11.100 {
};
view "nets" {
match-clients { nets; };
recursion yes;
zone "l1.lan" {
type master;
file "/etc/bind/master/l1.lan.zone";
allow-transfer {
127.0.0.1; # localhost
172.23.11.1;
172.23.11.100;
};
notify yes;
};
zone "site4.ru" {
type master;
file "/etc/bind/master/site4.ru.zone";
allow-transfer {
127.0.0.1; # localhost
172.23.11.1;
172.23.11.100;
};
notify yes;
};
zone "site5.su" {
type master;
file "/etc/bind/master/site5.su.zone";
allow-transfer {
127.0.0.1; # localhost
172.23.11.1;
172.23.11.100;
};
notify yes;
};
zone "site6.ru" {
type master;
file "/etc/bind/master/site6.ru.zone";
allow-transfer {
127.0.0.1; # localhost
172.23.11.1;
172.23.11.100;
};
notify yes;
};
cat /etc/bind/nets
acl nets {
172.23.11.0/24;
172.23.103.0/24;
172.23.104.0/24;
};
cat /etc/bind/named.conf.options
acl trusted {
172.23.11.1;
172.23.11.100;
};
options {
directory "/var/cache/bind";
recursion yes; # enables resursive queries
allow-recursion { trusted; }; # allows recursive queries from "trusted" clients
listen-on { 172.23.11.1; };
allow-transfer {
// none;
172.23.11.100;
};
forwarders {
8.8.8.8;
8.8.4.4;
};
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
// forwarders {
// 0.0.0.0;
// };
//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys. See https://www.isc.org/bind-keys
//========================================================================
dnssec-validation auto;
auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
};
Пингую какой-либо хост из данных зон, все ОК.
Перехожу в браузере по адресу, который находиться в локалке, все ОК.
Но, если я хочу перейти по какому-либо адресу в интернете, на тот же яндекс, получаю фигу...
Что у меня не так? Или что нужно добавить?
Тема: bind не выпускает наружу (Прочитано 1400 раз)
