{"id":33717,"date":"2019-10-31T21:54:20","date_gmt":"2019-10-31T18:54:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet\/"},"modified":"2019-10-31T21:54:20","modified_gmt":"2019-10-31T18:54:20","slug":"delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","title":{"rendered":"Delegation af reverse zone for subnet mindre end \/24 i BIND. Hvordan det fungerer","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En dag stod jeg over for opgaven at give en af mine kunder rettigheder til at redigere PTR-posterne for den tildelte subnet \/28. Jeg har ingen automatisering til at redigere BIND-indstillinger udefra. Derfor besluttede jeg mig for at tage en anden vej - at delegere en del af PTR-zonen af subnet \/24 til kunden.<\/p>\n

Det burde v\u00e6re enkelt, ikke? Vi angiver blot subnettet korrekt og peger p\u00e5 den \u00f8nskede NS, som man g\u00f8r med underdom\u00e6ner. Men nej. Det er ikke s\u00e5 enkelt (selvom det faktisk er ganske primitivt, men intuitionen hj\u00e6lper ikke), derfor skriver jeg denne artikel.<\/p>\n

Den, der vil finde ud af det selv, kan l\u00e6se RFC<\/a><\/noindex>
\nDen, der \u00f8nsker en f\u00e6rdig l\u00f8sning, er velkommen under cut.
\n<\/a><\/noindex>
\nFor ikke at forsinke dem, der elsker metode kopier og inds\u00e6t, vil jeg f\u00f8rst offentligg\u00f8re den praktiske del, og derefter den teoretiske.<\/p>\n

1. Praksis. Vi delegere zonen \/28.<\/b><\/p>\n

Lad os antage, at vi har en subnet. 7.8.9.0\/24<\/b>. Vi skal delegere subnettet 7.8.9.240\/28<\/b> til DNS-klienten 7.8.7.8<\/b> (ns1.client.domain<\/b>).<\/p>\n

P\u00e5 udbyderens DNS skal vi finde filen, som beskriver den omvendte zone for dette subnet. Lad det v\u00e6re 9.8.7.in-addr.arpa<\/b>.
\nPoster fra 240 til 255 kommenteres, hvis der er nogen. Og til slutningen af filen skriver vi f\u00f8lgende:<\/p>\n

255-240  IN  NS      7.8.7.8\n$GENERATE 240-255 $ CNAME $.255-240<\/code><\/pre>\n
\nHusk at \u00f8ge zonens serial og k\u00f8r <\/p>\n
rndc reload<\/code><\/pre>\n
\nDette afslutter udbyderens del. Lad os g\u00e5 videre til klientens DNS.<\/p>\n
F\u00f8rst opretter vi filen \/etc\/bind\/master\/255-240.9.8.7.in-addr.arpa<\/b> med f\u00f8lgende indhold:<\/p>\n
$ORIGIN 255-240.9.8.7.in-addr.arpa.\n$TTL 1W\n@ 1D IN SOA ns1.client.domain. root.client.domain. (\n2008152607 ; serial\n3H ; refresh\n15M ; retry\n1W ; expiry\n1D ) ; minimum\n@ IN NS ns1.client.domain.\n@ IN NS ns2.client.domain.\n241 IN PTR test.client.domain.\n242 IN PTR test2.client.domain.\n245 IN PTR test5.client.domain.\n<\/code><\/pre>\n
\nOg i named.conf<\/b> tilf\u00f8jer vi beskrivelsen af vores nye fil:<\/p>\n
zone \"255-240.9.8.7.in-addr.arpa.\" IN {\ntype master;\nfile \"master\/255-240.9.8.7.in-addr.arpa\";\n};<\/code><\/pre>\n
\nB genstarter bind-processen.<\/p>\n
\/etc\/init.d\/named restart<\/code><\/pre>\n
\nDet er alt. Nu kan vi kontrollere.<\/p>\n
#>  host 7.8.9.245 \n245.9.8.7.in-addr.arpa is an alias for 245.255-240.9.8.7.in-addr.arpa.\n245.255-240.9.8.7.in-addr.arpa domain name pointer test5.client.domain.<\/code><\/pre>\n
\nBem\u00e6rk, at der ikke kun gives PTR-poster, men ogs\u00e5 CNAME. Det er s\u00e5dan, det skal v\u00e6re. Hvis du er interesseret i hvorfor, er du velkommen til n\u00e6ste kapitel.<\/p>\n
2. Teori. Hvordan det fungerer.<\/b><\/p>\n
Det er sv\u00e6rt at konfigurere og debugge en sort boks. Meget lettere, hvis man forst\u00e5r, hvad der sker indeni.<\/p>\n
N\u00e5r vi delegere en underdom\u00e6ne i dom\u00e6net dom\u00e6ne<\/b>, skriver vi noget i stil med dette:<\/p>\n
client.domain.\tNS\tns1.client.domain.\nns1.client.domain.\tA\t7.8.7.8<\/code><\/pre>\n
\nVi informerer alle, der sp\u00f8rger, at vi ikke er ansvarlige for dette omr\u00e5de og fort\u00e6ller, hvem der er ansvarlig. Og alle foresp\u00f8rgsler p\u00e5 client.domain<\/b> bliver omdirigeret til 7.8.7.8. Ved kontrol ser vi f\u00f8lgende billede (lad os antage, at der er noget hos klienten, det er ikke vigtigt):<\/p>\n
# host test.client.domain\ntest.client.domain has address 7.8.9.241<\/code><\/pre>\n
\nDet vil sige, vi er blevet informeret om, at der findes en A-post, og dens IP er 7.8.9.241. Ingen ekstra information.<\/p>\n
Hvordan kan man g\u00f8re det samme med et subnet?<\/b><\/p>\n
Da vores DNS-server er registreret i RIPE, vil den f\u00f8rste foresp\u00f8rgsel p\u00e5 PTR IP-adressen fra vores netv\u00e6rk stadig v\u00e6re til os. Logikken er den samme som med dom\u00e6ner. Men hvordan skriver man subnettet ind i zonefilen?<\/p>\n
Vi pr\u00f8ver at skrive det s\u00e5dan her:<\/p>\n
255-240  IN  NS      7.8.7.8<\/code><\/pre>\n
\nOg... miraklet skete ikke. Vi modtager ingen omdirigering af anmodningen. Problemet er, at bind slet ikke er klar over, at disse poster i den omvendte zonefil er IP-adresser, og han forst\u00e5r slet ikke intervaloptegnelsen. For ham er det bare en eller anden symbolsk underdom\u00e6ne. Dvs. for bind vil der ikke v\u00e6re nogen forskel mellem \u00ab255-240<\/b>» og «oursuperclient<\/b>\u00bb. Og for at anmodningen skal g\u00e5 det rigtige sted, skal adressen i anmodningen se s\u00e5dan ud: 241.255-240.9.8.7.in-addr.arpa<\/b>. Eller s\u00e5dan her, hvis vi bruger et symbolsk underdom\u00e6ne: 241.oursuperclient.9.8.7.in-addr.arpa<\/b>. Dette adskiller sig fra den almindelige: 241.9.8.7.in-addr.arpa<\/b>.<\/p>\n
Det vil v\u00e6re problematisk at lave en s\u00e5dan foresp\u00f8rgsel manuelt. Og hvis det lykkes, er det stadig uklart, hvordan man anvender dette i praksis. For ved foresp\u00f8rgslen 7.8.9.241<\/b> vil vi stadig f\u00e5 svar fra udbyderens DNS, ikke klientens.<\/p>\n
Men her kommer CNAME<\/b>.<\/p>\n
I udbyderens side skal der laves et alias for alle IP-adresser i subnettet i det format, som videresender foresp\u00f8rgslen til klientens DNS.<\/p>\n
255-240  IN  NS      ns1.client.domain.\n241     IN  CNAME   241.255-240\n242     IN  CNAME   242.255-240\nog s\u00e5 videre.\n<\/code><\/pre>\n
\nDette er for de flittige =). <\/p>\n
Og for de dovne passer nedenst\u00e5ende konstruktion bedre:<\/p>\n
255-240  IN  NS      ns1.client.domain.\n$GENERATE 240-255 $ CNAME $.255-240<\/code><\/pre>\n
\nNu vil foresp\u00f8rgslen om information om adressen 7.8.9.241<\/b> af 241.9.8.7.in-addr.arpa<\/b> p\u00e5 udbyderens DNS-server blive omdannet til 241.255-240.9.8.7.in-addr.arpa<\/b> og sendes til DNS-klienten. <\/p>\n
P\u00e5 klientens side skal s\u00e5danne foresp\u00f8rgsler behandles. Derfor opretter vi en zone 255-240.9.8.7.in-addr.arpa<\/b>. I den kan vi i princippet placere omvendte poster for alle IP'er i hele subnettet \/24, men der vil kun blive spurgt om dem, som udbyderen videresender til os, s\u00e5 vi kan ikke lege for meget =).
\nFor at illustrere vil jeg endnu engang give et eksempel p\u00e5 indholdet af den omvendte zonefil fra klientens side:<\/p>\n
$ORIGIN 255-240.9.8.7.in-addr.arpa.\n$TTL 1W\n@ 1D IN SOA ns1.client.domain. root.client.domain. (\n2008152607 ; serial\n3H ; refresh\n15M ; retry\n1W ; expiry\n1D ) ; minimum\n@ IN NS ns1.client.domain.\n@ IN NS ns2.client.domain.\n241 IN PTR test.client.domain.\n242 IN PTR test2.client.domain.\n245 IN PTR test5.client.domain.\n<\/code><\/pre>\n
\nDet er fordi, vi fra udbyderens side bruger CNAME, at vi modtager to poster som svar p\u00e5 foresp\u00f8rgslen om data. IP-adresse<\/a> to poster i stedet for en.<\/p>\n
#>  host 7.8.9.245 \n245.9.8.7.in-addr.arpa is an alias for 245.255-240.9.8.7.in-addr.arpa.\n245.255-240.9.8.7.in-addr.arpa domain name pointer test5.client.domain.<\/code><\/pre>\n
\nOg husk at indstille ACL korrekt. For det giver ikke mening at tage PTR-zonen til sig og ikke svare nogen udefra =).<\/b><\/i>
\n
Kilde: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0441\u0442\u0430\u043b\u0430 \u043e\u0434\u043d\u0430\u0436\u0434\u044b \u043f\u0435\u0440\u0435\u0434\u043e \u043c\u043d\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0430, \u043e\u0442\u0434\u0430\u0442\u044c \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0430\u0432\u043e \u043d\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 PTR-\u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043e\u0442\u0434\u0430\u043d\u043d\u043e\u0439 \u0435\u043c\u0443 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/28. \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a BIND \u0438\u0437\u0432\u043d\u0435 \u0443 \u043c\u0435\u043d\u044f \u043d\u0435\u0442. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0440\u0435\u0448\u0438\u043b \u043f\u043e\u0439\u0442\u0438 \u0434\u0440\u0443\u0433\u0438\u043c \u043f\u0443\u0442\u0435\u043c \u2014 \u0434\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043b\u0438\u0435\u043d\u0442\u0443 \u043a\u0443\u0441\u043e\u043a PTR-\u0437\u043e\u043d\u044b \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/24. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b \u2014 \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0449\u0435? \u041f\u0440\u043e\u0441\u0442\u043e \u043d\u0443\u0436\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043f\u0440\u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c \u043f\u043e\u0434\u0441\u0435\u0442\u044c \u0438 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c \u043d\u0430 \u043d\u0443\u0436\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33717","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Delegation af omvendt zoner for subnet mindre end \/24 i BIND. Hvordan det fungerer | ProHoster","description":"En gang stod jeg over for opgaven at give en af vores kunder ret til at redigere PTR-posterne for den tildelte subnet \/28. Jeg har ikke automatisering til at redigere BIND-indstillinger udefra.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0437\u043e\u043d\u044b \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u043c\u0435\u043d\u0435\u0435 \/24 \u0432 BIND. \u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 | ProHoster","og:description":"\u0412\u0441\u0442\u0430\u043b\u0430 \u043e\u0434\u043d\u0430\u0436\u0434\u044b \u043f\u0435\u0440\u0435\u0434\u043e \u043c\u043d\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0430, \u043e\u0442\u0434\u0430\u0442\u044c \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0430\u0432\u043e \u043d\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 PTR-\u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043e\u0442\u0434\u0430\u043d\u043d\u043e\u0439 \u0435\u043c\u0443 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/28. \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a BIND \u0438\u0437\u0432\u043d\u0435 \u0443 \u043c\u0435\u043d\u044f \u043d\u0435\u0442.","og:url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:20+00:00","article:modified_time":"2019-10-31T18:54:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33717","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:27:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:35:31","updated":"2026-02-08 20:27:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/33717","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=33717"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/33717\/revisions"}],"predecessor-version":[{"id":157777,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/33717\/revisions\/157777"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=33717"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=33717"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=33717"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}