{"id":33717,"date":"2019-10-31T21:54:20","date_gmt":"2019-10-31T18:54:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet\/"},"modified":"2019-10-31T21:54:20","modified_gmt":"2019-10-31T18:54:20","slug":"delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","title":{"rendered":"Alamissubneti tagasil\u00f6\u00f6gi delegatsioon BIND-is v\u00e4hem kui \/24. Kuidas see t\u00f6\u00f6tab","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00dcks kord seisin silmitsi \u00fclesandega anda \u00fche kliendi \u00f5igused redigeerida PTR-kirjeid tema antud \/28 alamv\u00f5rgus. Mul ei olnud automatiseerimist BIND-i seadete v\u00e4lispidiselt muutmiseks. Seet\u00f5ttu otsustasin minna teist teed \u2014 delegeerida kliendile PTR-tsooni osa \/24 alamv\u00f5rgust.<\/p>\n

Tundub, et mis v\u00f5iks olla lihtsam? Lihtsalt kirjutame alamv\u00f5rgu \u00f5igesti ja suuname vajaliku NS-i poole, nagu seda tehakse alamdomeeniga. Kuid ei. K\u00f5ik ei ole nii lihtne (kuigi tegelikult on see primitiivne, kuid intuitsioon ei aita), seega kirjutangi ma selle artikli.<\/p>\n

Kes soovib ise asja v\u00e4lja selgitada, v\u00f5ib lugeda RFC<\/a><\/noindex>
\nKes soovib valmis lahendust, on teretulnud edasi lugema.
\n<\/a><\/noindex>
\nKuna ma ei soovi viivitada nendega, kes armastavad kopeerida ja kleepida, esitan k\u00f5igepealt praktilise osa ja seej\u00e4rel teoreetilise.<\/p>\n

1. Praktika. Delegeerime tsooni \/28<\/b><\/p>\n

Oletame, et meil on alamv\u00f5rk 7.8.9.0\/24<\/b>. Peame delegeerima alamv\u00f5rgu 7.8.9.240\/28<\/b> DNS-klientile 7.8.7.8<\/b> (ns1.client.domain<\/b>).<\/p>\n

Teenusepakkuja DNS-is peate leidma faili, mis kirjeldab tagasikutsumise tsooni selle alamv\u00f5rgu jaoks. Olgu see 9.8.7.in-addr.arpa<\/b>.
\nM\u00e4rgi eemaldage k\u00f5ik kirjed vahemikus 240 kuni 255, kui need on olemas. Ja faili l\u00f5ppu kirjutame j\u00e4rgmist:<\/p>\n

255-240 IN NS 7.8.7.8\n$GENERATE 240-255 $ CNAME $.255-240<\/code><\/pre>\n
\n\u00c4rge unustage suurendada tsooni seriali ja tehke <\/p>\n
rndc reload<\/code><\/pre>\n
\nSellega on teenusepakkuja osa l\u00f5petatud. Liigume kliendi DNS-i juurde.<\/p>\n
Alustame faili loomisega \/etc\/bind\/master\/255-240.9.8.7.in-addr.arpa<\/b> j\u00e4rgnevate sisu:<\/p>\n
$ORIGIN 255-240.9.8.7.in-addr.arpa.\n$TTL 1W\n@ 1D IN SOA ns1.client.domain. root.client.domain. (\n 2008152607 ; serial\n 3H ; refresh\n 15M ; retry\n 1W ; expiry\n 1D ) ; minimum\n@ IN NS ns1.client.domain.\n@ IN NS ns2.client.domain.\n241 IN PTR test.client.domain.\n242 IN PTR test2.client.domain.\n245 IN PTR test5.client.domain.\n<\/code><\/pre>\n
\nJa named.conf<\/b> lisame kirjelduse meie uuele failile:<\/p>\n
zone \"255-240.9.8.7.in-addr.arpa.\" IN {\n type master;\n file \"master\/255-240.9-8-7.in-addr.arpa\";\n};<\/code><\/pre>\n
\nB taask\u00e4ivitage bind protsess.<\/p>\n
\/etc\/init.d\/named restart<\/code><\/pre>\n
\nK\u00f5ik. N\u00fc\u00fcd saab kontrollida.<\/p>\n
#>  host 7.8.9.245 \n245.9.8.7.in-addr.arpa is an alias for 245.255-240.9.8.7.in-addr.arpa.\n245.255-240.9.8.7.in-addr.arpa domain name pointer test5.client.domain.<\/code><\/pre>\n
\nPange t\u00e4hele, et tagastatakse mitte ainult PTR-kirje, vaid ka CNAME. Nii peab olema. Kui see huvitab, siis teretulemast j\u00e4rgmisesse peat\u00fckki.<\/p>\n
2. Teooria. Kuidas see t\u00f6\u00f6tab.<\/b><\/p>\n
Must kasti seadistamine ja t\u00f5rkeotsing on keeruline. Palju lihtsam on, kui m\u00f5istad, mis seal sees toimub.<\/p>\n
Kui me k\u00e4sitleme alamdomeeni domeenis domain<\/b>, siis kirjutame midagi sellist:<\/p>\n
client.domain.\tNS\tns1.client.domain.\nns1.client.domain.\tA\t7.8.7.8<\/code><\/pre>\n
\nKellelegi, kes k\u00fcsib, \u00fctleme, et selle osa eest ei vastuta ja nemad \u00fctlevad, kes vastutab. K\u00f5ik p\u00e4ringud suunatakse client.domain<\/b> aadressile 7.8.7.8. Kontrollimisel n\u00e4eme j\u00e4rgmist pilti (j\u00e4tame kliendi olukorra k\u00f5rvale, see pole oluline):<\/p>\n
# host test.client.domain\ntest.client.domain has address 7.8.9.241<\/code><\/pre>\n
\nSee t\u00e4hendab, et meile teatatakse, et selline A-kirje on olemas ja selle IP 7.8.9.241. \u00dchtegi liigset teavet.<\/p>\n
Kuidas sama teha alamv\u00f5rguga?<\/b><\/p>\n
Kuna meie DNS-server on registreeritud RIPE's, siis PTR p\u00e4ringu puhul meie v\u00f5rgu IP-aadressist l\u00e4heb esimene p\u00e4ring siiski meie poole. Loogika on sama, mis domeenide puhul. Ainult k\u00fcsimus on, kuidas kirjutada alamv\u00f5rk tsoonifaili?<\/p>\n
Proovime kirjutada nii:<\/p>\n
255-240  IN  NS      7.8.7.8<\/code><\/pre>\n
\nJa\u2026 imet ei juhtunud. Me ei saa mingit p\u00e4ringu \u00fcmbersuunamist. Asi on selles, et bind ei tea \u00fcldse, et need kirjed tagasip\u00f6\u00f6ramise failis on IP-aadressid ja veel v\u00e4hem m\u00f5istab ta vahemiku kirjet. Tema jaoks on see lihtsalt mingi s\u00fcmboolne alamdomeen. T\u00e4hendab, bindile ei ole vahet, kas on «255-240<\/b>» ja «oursuperclient<\/b>«. Ja et p\u00e4ring l\u00e4heks \u00f5igesse kohta, peab p\u00e4ringu aadress v\u00e4lja n\u00e4gema nii: 241.255-240.9.8.7.in-addr.arpa<\/b>. V\u00f5i nii, kui me kasutame s\u00fcmboolset alamdomeeni: 241.oursuperclient.9.8.7.in-addr.arpa<\/b>. See erineb tavalisest: 241.9.8.7.in-addr.arpa<\/b>.<\/p>\n
Sellise p\u00e4ringu t\u00e4itmine k\u00e4tega on keeruline. Isegi kui see \u00f5nnestub, ei ole selge, kuidas seda reaalses elus rakendada. Sest p\u00e4ringu j\u00e4rgi 7.8.9.241<\/b> vastab endiselt teenusepakkuja DNS, mitte kliendi.<\/p>\n
Siin astub m\u00e4ngu CNAME<\/b>.<\/p>\n
Teenusepakkuja poolel tuleb k\u00f5ikide alamv\u00f5rgu IP-aadresside jaoks luua alias, mis suunab p\u00e4ringu kliendi DNS-ile.<\/p>\n
255-240  IN  NS      ns1.client.domain.\n241     IN  CNAME   241.255-240\n242     IN  CNAME   242.255-240\njne.\n<\/code><\/pre>\n
\nSee on t\u00f6\u00f6ka jaoks =). <\/p>\n
Aga laisematele sobib rohkem allolev konstruktsioon:<\/p>\n
255-240  IN  NS      ns1.client.domain.\n$GENERATE 240-255 $ CNAME $.255-240<\/code><\/pre>\n
\nN\u00fc\u00fcd muudetakse p\u00e4ring teabe saamiseks aadressil 7.8.9.241<\/b> kohast 241.9.8.7.in-addr.arpa<\/b> teenusepakkuja DNS-serveris 241.255-240.9.8.7.in-addr.arpa<\/b> ja saadetakse kliendi DNS-ile. <\/p>\n
Kliendi poolel tuleb selliseid p\u00e4ringuid t\u00f6\u00f6delda. Seet\u00f5ttu loome tsooni 255-240.9.8.7.in-addr.arpa<\/b>. Selles saame p\u00f5him\u00f5tteliselt paigutada p\u00f6\u00f6rdwrite'e k\u00f5ikide alamv\u00f5rgu \/24 IP-de jaoks, kuid meilt k\u00fcsitakse ainult nende kohta, mida teenusepakkuja meie poole suunab, seega ei saa siin naljatleda =).
\nIllustratsioonina tuletan veel kord meelde kliendi poole p\u00f6\u00f6rdwrite-faili sisu n\u00e4idet:<\/p>\n
$ORIGIN 255-240.9.8.7.in-addr.arpa.\n$TTL 1W\n@ 1D IN SOA ns1.client.domain. root.client.domain. (\n 2008152607 ; serial\n 3H ; refresh\n 15M ; retry\n 1W ; expiry\n 1D ) ; minimum\n@ IN NS ns1.client.domain.\n@ IN NS ns2.client.domain.\n241 IN PTR test.client.domain.\n242 IN PTR test2.client.domain.\n245 IN PTR test5.client.domain.\n<\/code><\/pre>\n
\nKuna kasutame pakkuja poolt CNAME'i, saame vastuseks andmep\u00e4ringu kohta IP-aadressi<\/a> kahe kirje, mitte \u00fchte.<\/p>\n
#>  host 7.8.9.245 \n245.9.8.7.in-addr.arpa is an alias for 245.255-240.9.8.7.in-addr.arpa.\n245.255-240.9.8.7.in-addr.arpa domain name pointer test5.client.domain.<\/code><\/pre>\n
\n\u00c4rge unustage ACL-i \u00f5igesti seadistada. Pole m\u00f5tet v\u00f5tta endale PTR-ala ja mitte vastata v\u00e4listele p\u00e4ringutele =).<\/b><\/i>
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0441\u0442\u0430\u043b\u0430 \u043e\u0434\u043d\u0430\u0436\u0434\u044b \u043f\u0435\u0440\u0435\u0434\u043e \u043c\u043d\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0430, \u043e\u0442\u0434\u0430\u0442\u044c \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0430\u0432\u043e \u043d\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 PTR-\u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043e\u0442\u0434\u0430\u043d\u043d\u043e\u0439 \u0435\u043c\u0443 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/28. \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a BIND \u0438\u0437\u0432\u043d\u0435 \u0443 \u043c\u0435\u043d\u044f \u043d\u0435\u0442. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0440\u0435\u0448\u0438\u043b \u043f\u043e\u0439\u0442\u0438 \u0434\u0440\u0443\u0433\u0438\u043c \u043f\u0443\u0442\u0435\u043c \u2014 \u0434\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043b\u0438\u0435\u043d\u0442\u0443 \u043a\u0443\u0441\u043e\u043a PTR-\u0437\u043e\u043d\u044b \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/24. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b \u2014 \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0449\u0435? \u041f\u0440\u043e\u0441\u0442\u043e \u043d\u0443\u0436\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043f\u0440\u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c \u043f\u043e\u0434\u0441\u0435\u0442\u044c \u0438 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c \u043d\u0430 \u043d\u0443\u0436\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33717","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Alamv\u00f5rgu v\u00e4hem kui \/24 vastusala delegeerimine BIND-is. Kuidas see t\u00f6\u00f6tab | ProHoster","description":"\u00dchel p\u00e4eval seisis mul \u00fclesanne anda \u00fche kliendi \u00f5igused PTR-kirjete redigeerimiseks antud alamv\u00f5rgu \/28 kohta. Mul ei ole automaatikat BIND-i seadete v\u00e4listamiseks redigeerimiseks. Seet\u00f5ttu otsustasin minna teist teed \u2014 delegeerida kliendile PTR-ala osa alamv\u00f5rgu \/24 kohta. Tundub, et mis v\u00f5iks olla lihtsam? Lihtsalt m\u00e4\u00e4rame \u00f5igesti alamv\u00f5rgu ja suuname selle vajalikku","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0437\u043e\u043d\u044b \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u043c\u0435\u043d\u0435\u0435 \/24 \u0432 BIND. \u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 | ProHoster","og:description":"\u0412\u0441\u0442\u0430\u043b\u0430 \u043e\u0434\u043d\u0430\u0436\u0434\u044b \u043f\u0435\u0440\u0435\u0434\u043e \u043c\u043d\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0430, \u043e\u0442\u0434\u0430\u0442\u044c \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0430\u0432\u043e \u043d\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 PTR-\u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043e\u0442\u0434\u0430\u043d\u043d\u043e\u0439 \u0435\u043c\u0443 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/28. \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a BIND \u0438\u0437\u0432\u043d\u0435 \u0443 \u043c\u0435\u043d\u044f \u043d\u0435\u0442. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0440\u0435\u0448\u0438\u043b \u043f\u043e\u0439\u0442\u0438 \u0434\u0440\u0443\u0433\u0438\u043c \u043f\u0443\u0442\u0435\u043c \u2014 \u0434\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043b\u0438\u0435\u043d\u0442\u0443 \u043a\u0443\u0441\u043e\u043a PTR-\u0437\u043e\u043d\u044b \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/24. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b \u2014 \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0449\u0435? \u041f\u0440\u043e\u0441\u0442\u043e \u043d\u0443\u0436\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043f\u0440\u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c \u043f\u043e\u0434\u0441\u0435\u0442\u044c \u0438 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c \u043d\u0430 \u043d\u0443\u0436\u043d\u044b\u0439","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:20+00:00","article:modified_time":"2019-10-31T18:54:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33717","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:27:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:35:31","updated":"2026-02-08 20:27:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/33717","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=33717"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/33717\/revisions"}],"predecessor-version":[{"id":157777,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/33717\/revisions\/157777"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=33717"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=33717"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=33717"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}