{"id":33717,"date":"2019-10-31T21:54:20","date_gmt":"2019-10-31T18:54:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet\/"},"modified":"2019-10-31T21:54:20","modified_gmt":"2019-10-31T18:54:20","slug":"delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","title":{"rendered":"Delegowanie odwrotnej strefy podsieci mniejszej ni\u017c \/24 w BIND. Jak to dzia\u0142a","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pewnego dnia stan\u0119\u0142o przede mn\u0105 zadanie, aby przyzna\u0107 jednemu z klient\u00f3w prawo do edytowania zapis\u00f3w PTR w przypisanej mu podsieci \/28. Nie mam automatyzacji do edytowania ustawie\u0144 BIND zdalnie. Postanowi\u0142em wi\u0119c p\u00f3j\u015b\u0107 inn\u0105 drog\u0105 - delegowa\u0107 klientowi cz\u0119\u015b\u0107 strefy PTR podsieci \/24.<\/p>\n

Wydawa\u0142oby si\u0119 - co mo\u017ce by\u0107 prostszego? Po prostu odpowiednio zapisujemy podsie\u0107 i kierujemy na odpowiedni NS, jak to si\u0119 robi z subdomen\u0105. Ale nie. Nie jest to takie proste (chocia\u017c w rzeczywisto\u015bci jest to bardzo proste, ale intuicja nie pomo\u017ce), dlatego pisz\u0119 ten artyku\u0142.<\/p>\n

Kto chce samodzielnie si\u0119 zg\u0142\u0119bi\u0107 w temat, mo\u017ce poczyta\u0107. RFC<\/a><\/noindex>
\nKto chce gotowego rozwi\u0105zania, zapraszam dalej.
\n<\/a><\/noindex>
\nAby nie sp\u00f3\u017ania\u0107 tych, kt\u00f3rzy lubi\u0105 metod\u0119 kopiuj-wklej, najpierw umieszcz\u0119 cz\u0119\u015b\u0107 praktyczn\u0105, a po niej cz\u0119\u015b\u0107 teoretyczn\u0105.<\/p>\n

1. Praktyka. Delegujemy stref\u0119 \/28.<\/b><\/p>\n

Za\u0142\u00f3\u017cmy, \u017ce mamy podsie\u0107. 7.8.9.0\/24<\/b>Musimy delegowa\u0107 podsie\u0107 7.8.9.240\/28<\/b> do klienta dns. 7.8.7.8<\/b> (ns1.client.domain.<\/b>).<\/p>\n

Na serwerze dns dostawcy nale\u017cy znale\u017a\u0107 plik opisuj\u0105cy odwrotn\u0105 stref\u0119 tej podsieci. Niech to b\u0119dzie 9.8.7.in-addr.arpa.<\/b>.
\nZapisujemy od 240 do 255 w komentarzach, je\u015bli s\u0105. A na ko\u0144cu pliku zapisujemy nast\u0119puj\u0105ce:<\/p>\n

255-240  IN  NS      7.8.7.8\n$GENERATE 240-255 $ CNAME $.255-240<\/code><\/pre>\n
\nnie zapominamy zwi\u0119kszy\u0107 serial strefy i wykonujemy <\/p>\n
rndc reload.<\/code><\/pre>\n
\nNa tym cz\u0119\u015b\u0107 dostawcy jest zako\u0144czona. Przechodzimy do klienta dns.<\/p>\n
Na pocz\u0105tek stworzymy plik \/etc\/bind\/master\/255-240.9.8.7.in-addr.arpa<\/b> zawarto\u015bci:<\/p>\n
$ORIGIN 255-240.9.8.7.in-addr.arpa.\n$TTL 1W\n@                       1D IN SOA       ns1.client.domain. root.client.domain. (\n                        2008152607      ; serial\n                        3H              ; refresh\n                        15M             ; retry\n                        1W              ; expiry\n                        1D )            ; minimum\n@                       IN NS        ns1.client.domain.\n@                       IN NS        ns2.client.domain.\n241                     IN PTR          test.client.domain.\n242                     IN PTR          test2.client.domain.\n245                     IN PTR          test5.client.domain.\n<\/code><\/pre>\n
\nI w named.conf<\/b> dodajemy opis naszego nowego pliku:<\/p>\n
strefa \"255-240.9.8.7.in-addr.arpa.\" IN {\n        typ master;\n        plik \"master\/255-240.9.8.7.in-addr.arpa\";\n};<\/code><\/pre>\n
\nB restartujemy proces bind.<\/p>\n
\/etc\/init.d\/named restart<\/code><\/pre>\n
\nTo wszystko. Teraz mo\u017cna to sprawdza\u0107.<\/p>\n
#>  host 7.8.9.245 \n245.9.8.7.in-addr.arpa is an alias for 245.255-240.9.8.7.in-addr.arpa.\n245.255-240.9.8.7.in-addr.arpa domain name pointer test5.client.domain.<\/code><\/pre>\n
\nZwr\u00f3\u0107 uwag\u0119, \u017ce zwracany jest nie tylko zapis PTR, ale tak\u017ce CNAME. Tak ma by\u0107. Je\u015bli chcesz wiedzie\u0107 dlaczego, zapraszam do nast\u0119pnego rozdzia\u0142u.<\/p>\n
2. Teoria. Jak to dzia\u0142a.<\/b><\/p>\n
Trudno jest konfigurowa\u0107 i debugowa\u0107 czarn\u0105 skrzynk\u0119. O wiele \u0142atwiej jest, je\u015bli rozumiesz, co si\u0119 dzieje w \u015brodku.<\/p>\n
Gdy delegujemy subdomen\u0119 w domenie domena<\/b>, zapisujemy co\u015b w stylu tego:<\/p>\n
client.domain.\tNS\tns1.client.domain.\nns1.client.domain.\tA\t7.8.7.8<\/code><\/pre>\n
\nM\u00f3wimy wszystkim pytaj\u0105cym, \u017ce za ten fragment nie odpowiadamy i wskazujemy, kto odpowiada. Wszystkie zapytania dotycz\u0105ce client.domain<\/b> s\u0105 przekierowywane na 7.8.7.8. Podczas sprawdzania widzimy nast\u0119puj\u0105cy obrazek (pomijamy, co tam u klienta. To nieistotne):<\/p>\n
# host test.client.domain\ntest.client.domain has address 7.8.9.241<\/code><\/pre>\n
\nCzyli poinformowano nas, \u017ce istnieje taki rekord A i jego IP to 7.8.9.241. \u017badnych dodatkowych informacji.<\/p>\n
A jak mo\u017cna zrobi\u0107 to samo z podsieci\u0105?<\/b><\/p>\n
Poniewa\u017c nasz serwer DNS jest zapisany w RIPE, przy \u017c\u0105daniu PTR adresu IP z naszej sieci, pierwszy wniosek i tak b\u0119dzie skierowany do nas. Logika jest taka sama jak w przypadku domen. Tylko jak wpisa\u0107 podsie\u0107 w plik strefy?<\/p>\n
Pr\u00f3bujemy wpisa\u0107 to w ten spos\u00f3b:<\/p>\n
255-240  IN  NS      7.8.7.8<\/code><\/pre>\n
\nI... the miracle did not happen. We are not getting any request redirection. The thing is that bind is not aware that these records in the reverse zone file are IP addresses and, moreover, does not understand the range record. For it, this is simply a symbolic subdomain. That is, for bind, there will be no difference between \"255-240<\/b>\u201d oraz \u201eoursuperclient<\/b>\". And for the request to go to the right place, the address in the request must look like this: 241.255-240.9.8.7.in-addr.arpa<\/b>. Lub tak, je\u015bli u\u017cywamy symbolicznego poddomeny: 241.oursuperclient.9.8.7.in-addr.arpa<\/b>. To r\u00f3\u017cni si\u0119 od zwyk\u0142ego: 241.9.8.7.in-addr.arpa<\/b>.<\/p>\n
Taki wniosek b\u0119dzie trudny do zrealizowania r\u0119cznie. A je\u015bli si\u0119 uda, to i tak nie wiadomo, jak to zastosowa\u0107 w rzeczywisto\u015bci. Bowiem na zapytanie 7.8.9.241<\/b> odpowiada nam nadal DNS dostawcy, a nie klienta.<\/p>\n
A tutaj w gr\u0119 wchodz\u0105 CNAME<\/b>.<\/p>\n
Po stronie dostawcy nale\u017cy stworzy\u0107 alias dla wszystkich adres\u00f3w IP podsieci w formacie, kt\u00f3ry przekieruje zapytanie do DNS klienta.<\/p>\n
255-240  IN  NS      ns1.client.domain.\n241     IN  CNAME   241.255-240\n242     IN  CNAME   242.255-240\nitd.\n<\/code><\/pre>\n
\nTo dla pracowitych =). <\/p>\n
A dla leniwych lepsza b\u0119dzie konstrukcja poni\u017cej:<\/p>\n
255-240  IN  NS      ns1.client.domain.\n$GENERATE 240-255 $ CNAME $.255-240<\/code><\/pre>\n
\nTeraz zapytanie o informacje pod adresem 7.8.9.241<\/b> z 241.9.8.7.in-addr.arpa<\/b> na serwerze DNS dostawcy zostanie przekszta\u0142cone w 241.255-240.9.8.7.in-addr.arpa<\/b> i przejdzie do DNS klienta. <\/p>\n
Po stronie klienta b\u0119dzie trzeba obs\u0142u\u017cy\u0107 takie zapytania. Odpowiednio tworzymy stref\u0119 255-240.9.8.7.in-addr.arpa<\/b>. W niej w zasadzie mo\u017cemy umieszcza\u0107 odwrotne zapisy dla wszelkich IP ca\u0142ej podsieci \/24, ale zapytania b\u0119d\u0105 tylko dotycz\u0105ce tych, kt\u00f3re dostawca do nas przekazuje, wi\u0119c nie b\u0119dzie mo\u017cna si\u0119 tym zabawi\u0107 =).
\nDla ilustracji jeszcze raz podam przyk\u0142ad zawarto\u015bci pliku strefy odwrotnej po stronie klienta:<\/p>\n
$ORIGIN 255-240.9.8.7.in-addr.arpa.\n$TTL 1W\n@                       1D IN SOA       ns1.client.domain. root.client.domain. (\n                        2008152607      ; serial\n                        3H              ; refresh\n                        15M             ; retry\n                        1W              ; expiry\n                        1D )            ; minimum\n@                       IN NS        ns1.client.domain.\n@                       IN NS        ns2.client.domain.\n241                     IN PTR          test.client.domain.\n242                     IN PTR          test2.client.domain.\n245                     IN PTR          test5.client.domain.\n<\/code><\/pre>\n
\nPoniewa\u017c po stronie dostawcy u\u017cywamy CNAME, otrzymujemy w odpowiedzi na zapytanie dane dotycz\u0105ce adresu IP<\/a> dw\u00f3ch zapis\u00f3w, a nie jednego.<\/p>\n
#>  host 7.8.9.245 \n245.9.8.7.in-addr.arpa is an alias for 245.255-240.9.8.7.in-addr.arpa.\n245.255-240.9.8.7.in-addr.arpa domain name pointer test5.client.domain.<\/code><\/pre>\n
\nNie zapominajcie o prawid\u0142owej konfiguracji ACL. Bo nie ma sensu zabiera\u0107 sobie strefy PTR i nie odpowiada\u0107 nikomu z zewn\u0105trz =).<\/b><\/i>
\n
\u0179r\u00f3d\u0142o: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0441\u0442\u0430\u043b\u0430 \u043e\u0434\u043d\u0430\u0436\u0434\u044b \u043f\u0435\u0440\u0435\u0434\u043e \u043c\u043d\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0430, \u043e\u0442\u0434\u0430\u0442\u044c \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0430\u0432\u043e \u043d\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 PTR-\u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043e\u0442\u0434\u0430\u043d\u043d\u043e\u0439 \u0435\u043c\u0443 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/28. \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a BIND \u0438\u0437\u0432\u043d\u0435 \u0443 \u043c\u0435\u043d\u044f \u043d\u0435\u0442. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0440\u0435\u0448\u0438\u043b \u043f\u043e\u0439\u0442\u0438 \u0434\u0440\u0443\u0433\u0438\u043c \u043f\u0443\u0442\u0435\u043c \u2014 \u0434\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043b\u0438\u0435\u043d\u0442\u0443 \u043a\u0443\u0441\u043e\u043a PTR-\u0437\u043e\u043d\u044b \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/24. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b \u2014 \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0449\u0435? \u041f\u0440\u043e\u0441\u0442\u043e \u043d\u0443\u0436\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043f\u0440\u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c \u043f\u043e\u0434\u0441\u0435\u0442\u044c \u0438 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c \u043d\u0430 \u043d\u0443\u0436\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33717","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Delegowanie strefy zwrotnej podsieci poni\u017cej \/24 w BIND. Jak to dzia\u0142a | ProHoster","description":"Pewnego dnia stan\u0119\u0142o przede mn\u0105 zadanie, aby da\u0107 jednemu z klient\u00f3w prawo do edytowania rekord\u00f3w PTR dla przydzielonej mu podsieci \/28. Nie mam automatyzacji do edytowania ustawie\u0144 BIND z zewn\u0105trz.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0437\u043e\u043d\u044b \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u043c\u0435\u043d\u0435\u0435 \/24 \u0432 BIND. \u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 | ProHoster","og:description":"\u0412\u0441\u0442\u0430\u043b\u0430 \u043e\u0434\u043d\u0430\u0436\u0434\u044b \u043f\u0435\u0440\u0435\u0434\u043e \u043c\u043d\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0430, \u043e\u0442\u0434\u0430\u0442\u044c \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0430\u0432\u043e \u043d\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 PTR-\u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043e\u0442\u0434\u0430\u043d\u043d\u043e\u0439 \u0435\u043c\u0443 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/28. \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a BIND \u0438\u0437\u0432\u043d\u0435 \u0443 \u043c\u0435\u043d\u044f \u043d\u0435\u0442.","og:url":"https:\/\/prohoster.info\/pl\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:20+00:00","article:modified_time":"2019-10-31T18:54:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33717","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:27:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:35:31","updated":"2026-02-08 20:27:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/33717","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=33717"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/33717\/revisions"}],"predecessor-version":[{"id":157777,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/33717\/revisions\/157777"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=33717"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=33717"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=33717"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}