Ajuda com configuração do Bind com VIEWS [RESOLVIDO]

1. Ajuda com configuração do Bind com VIEWS [RESOLVIDO]

vilmarspies
(usa Slackware)

Enviado em 07/07/2015 - 15:20h

Olá estou precisando de ajuda para configurar um bind com views internas e externas. Fiz uma configuração aqui, mas a propagação está levando meu ip INTERNO e EXTERNO.
Utilizo para o servidor MASTER um CentOS 7 x64 e para SLAVE UBUNTU 14.04.2 LTS
Minha Infra é: Internet --> Firewall (com alias para os IPS externos) --> DMZ (MASTER e SLAVE) e firewall --> LAN

abaixo apresento o named.conf do MASTER:

acl mylist { 127.0.0.1; 192.168.100.0/24; 10.0.0.0/24; };

acl slave { 10.0.0.3;};



options {

	directory "/var/named";

	statistics-file "/var/named/data/named_stats.txt";

	memstatistics-file "/var/named/data/named_mem_stats.txt";

	dump-file "/var/named/data/cache_dump.db";

	zone-statistics yes;

	max-transfer-time-in 60;

//	interface-interval 0;

	version " Get Lost Pal, Please ";

	listen-on port 53 { mylist; };

	listen-on-v6 { none; };

	allow-query     { any; };

	recursion yes;

	allow-recursion {mylist;};

	allow-query-cache{ mylist; };

	allow-query-cache-on { any; };

	dnssec-enable yes;

	dnssec-validation yes;

	dnssec-lookaside auto;

	bindkeys-file "/etc/named.iscdlv.key";

	managed-keys-directory "/var/named/dynamic";

	pid-file "/run/named/named.pid";

	session-keyfile "/run/named/session.key";



	forwarders{

		131.100.8.1;8.8.8.8;8.8.4.4;};

	forward only;

};

view "internal" {

	match-clients {!slave; mylist; };

	//recursion yes;

	//allow-transfer { slave; };

	// Validacao de DNSSEC

	dnssec-validation no;

	dnssec-lookaside . trust-anchor dlv.isc.org.;



   zone "." IN {

	type hint;

	file "named.ca";

   };

    include "/etc/named.rfc1912.zones";

    zone "missal.pr.gov.br" {

        type master;

        file "missal.pr.gov.br-local";

        allow-update { none; };

   };

...

   zone "0.0.10.in-addr.arpa" IN {

        type master;

        file "10.local";

        allow-update { none; };

   };

   zone "100.168.192.in-addr.arpa" IN {

        type master;

        file "192.local";

        allow-update { none; }; 

   };

};

view "external" {

	match-clients {slave;!mylist; any; };

	//recursion no;

	additional-from-auth no;

	additional-from-cache no;

	allow-transfer { "slave"; };

   zone "missal.pr.gov.br" {

	type master;

	file "missal.pr.gov.br";

	allow-update { none; };

   };

...

   zone "240-255.11.100.131.in-addr.arpa" IN { 

	type master;

	file "131.100.11.local";

	allow-update { none; };

   };

};

include "/etc/named.root.key";

include "/etc/rndc.key";

controls {

	inet 127.0.0.1 port 953 allow { localhost; } keys { "rndc-key"; };

};

aqui o dominio EXTERNO

$TTL    1D 

@	IN SOA       thor.missal.pr.gov.br. admin.missal.pr.gov.br. (

                                        2015070604      ; serial (d. adams)

                                        1D              ; refresh 2H

                                        1H              ; retry 900

                                        1W              ; expiry 1209600

                                        3H )            ; minimum 86400



@                       IN      MX      5        thor.missal.pr.gov.br. 

@                       IN      NS      thor.missal.pr.gov.br.

@                       IN      A       131.100.11.244

@                       IN      NS      neuromancer.missal.pr.gov.br.

@                       IN      A       131.100.11.245



roteador                IN      A       131.100.11.241

modem			IN	A	131.100.11.242

guardiao                IN      A       131.100.11.243

thor                    IN      A       131.100.11.244

neuromancer             IN      A       131.100.11.245

hunter                  IN      A       131.100.11.246 

webmail                 IN      CNAME	thor

www						IN		CNAME	neuromancer

.......

Dominio INTERNO

$TTL    1D 

@	IN SOA       thor.missal.pr.gov.br. admin.missal.pr.gov.br. (

                                        2015070602      ; serial (d. adams)

                                        7200            ; refresh 2H

                                        15M             ; retry 900

                                        2W              ; expiry 1209600

                                        1D )            ; minimum 86400



@                       IN      MX      5        thor.missal.pr.gov.br. 

@                       IN      NS      thor.missal.pr.gov.br.

@			IN 	A	10.0.0.2

@                       IN      NS      neuromancer.missal.pr.gov.br.

@                       IN      A       10.0.0.3



roteador                IN      A       131.100.11.241

guardiao                IN      A       10.0.0.1

thor			IN	A	10.0.0.2

neuromancer             IN      A       10.0.0.3

www			IN	A	10.0.0.3

hunter                  IN      A       10.0.0.5

srvverrat		IN	A	10.0.0.6

backup			IN	A	10.0.0.7

skynet			IN	A	10.0.0.51

srvmissal		IN	A	10.0.0.243 

webmail                 IN      CNAME	thor

......

e aqui configuração do SLAVE

acl internalntw {127.0.0.1; 10.0.0.0/24; 192.168.100.0/24;};

options {

	directory "/var/cache/bind";

	statistics-file "/var/cache/bind/named.stats";

	memstatistics-file "/var/cache/bind/named.memstats";

	dump-file "/var/cache/bind/named.dump";

	zone-statistics yes;

//	notify no;

	allow-notify { 10.0.0.2;};

	listen-on {internalntw;};

	allow-query {any;};

	allow-recursion {internalntw;};

	allow-query-cache { internalntw;};

	allow-query-cache-on {any;};

	version "JETZT GEHTS LOS";



	forwarders {

		131.100.8.1; 8.8.8.8; 8.8.4.4;

	};

	forward only;

	dnssec-validation auto;



	auth-nxdomain no;    # conform to RFC1035

	listen-on-v6 { any; };

};



view "internal"{

	match-clients { internalntw; };

	recursion yes;

	// Validacao de DNSSEC

	dnssec-validation no;

	dnssec-lookaside . trust-anchor dlv.isc.org.;



   include "/etc/bind/named.conf.default-zones";



   zone "missal.pr.gov.br"{

	type slave;

	file "missal.pr.gov.br-local";

	masters{

		10.0.0.2;

	};

   };



.

.

.

   zone "0.0.10.in-addr.arpa"{

	type slave;

	file "10.local";

	masters{

		10.0.0.2;

	};

   };



   zone "100.168.192.in-addr.arpa" IN {

	type slave;

	file "192.local";

	masters {

		10.0.0.2;

	};

   };

};

view "external" {

        match-clients { any; };

        recursion no;

        additional-from-auth no;

        additional-from-cache no;

	transfer-source 10.0.0.3;



  zone "missal.pr.gov.br"{

        type slave;

	file "missal.pr.gov.br";

	masters{

		10.0.0.2;

	};

   };

.

.

.



   zone "240-255.11.100.131.in-addr.arpa"{

	type slave;

	file "131.100.11.local";

	masters{

		10.0.0.2;

	};

   };

};