{"id":33717,"date":"2019-10-31T21:54:20","date_gmt":"2019-10-31T18:54:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet\/"},"modified":"2019-10-31T21:54:20","modified_gmt":"2019-10-31T18:54:20","slug":"delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","title":{"rendered":"Delega\u00e7\u00e3o de uma zona reversa de sub-rede menor que \/24 no BIND. Como isso funciona","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Um dia, me deparei com a tarefa de conceder a um dos clientes o direito de editar os registros PTR da sub-rede \/28 que lhe foi dada. N\u00e3o tenho automa\u00e7\u00e3o para editar as configura\u00e7\u00f5es do BIND externamente. Portanto, decidi seguir por outro caminho \u2014 delegar ao cliente um peda\u00e7o da zona PTR da sub-rede \/24.<\/p>\n

\u00c0 primeira vista, poderia parecer simples. Basta escrever a sub-rede da maneira correta e direcion\u00e1-la para o NS apropriado, assim como fazemos com subdom\u00ednios. Mas n\u00e3o \u00e9 t\u00e3o simples. N\u00e3o \u00e9 nada complicado na verdade, mas a intui\u00e7\u00e3o n\u00e3o ajuda, por isso escrevo este artigo.<\/p>\n

Quem quiser entender por conta pr\u00f3pria, pode ler. RFC<\/a><\/noindex>
\nQuem quer uma solu\u00e7\u00e3o pronta, fique \u00e0 vontade para continuar.
\n<\/a><\/noindex>
\nPara n\u00e3o atrasar aqueles que adoram o m\u00e9todo do copiar e colar, primeiro eu vou apresentar a parte pr\u00e1tica, e depois a te\u00f3rica.<\/p>\n

1. Pr\u00e1tica. Delegamos a zona \/28.<\/b><\/p>\n

Suponhamos que temos uma sub-rede. 7.8.9.0\/24<\/b>. Precisamos delegar a sub-rede 7.8.9.240\/28<\/b> para o cliente DNS 7.8.7.8<\/b> (ns1.client.domain<\/b>).<\/p>\n

No DNS do provedor, precisamos encontrar o arquivo que descreve a zona reversa dessa sub-rede. Vamos cham\u00e1-lo de 9.8.7.in-addr.arpa<\/b>.
\nComentamos os registros de 240 a 255, se houver. E ao final do arquivo, escrevemos o seguinte:<\/p>\n

255-240  IN  NS      7.8.7.8\n$GENERATE 240-255 $ CNAME $.255-240<\/code><\/pre>\n
\nn\u00e3o esquecemos de aumentar o serial da zona e fazemos <\/p>\n
rndc reload<\/code><\/pre>\n
\nCom isso, a parte do provedor est\u00e1 conclu\u00edda. Vamos para o DNS do cliente.<\/p>\n
Para come\u00e7ar, vamos criar um arquivo \/etc\/bind\/master\/255-240.9.8.7.in-addr.arpa<\/b> users.module.ts<\/p>\n
$ORIGIN 255-240.9.8.7.in-addr.arpa.\n$TTL 1W\n@                       1D IN SOA       ns1.client.domain. root.client.domain. (\n                        2008152607      ; serial\n                        3H              ; refresh\n                        15M             ; retry\n                        1W              ; expiry\n                        1D )            ; minimum\n@                       IN NS        ns1.client.domain.\n@                       IN NS        ns2.client.domain.\n241                     IN PTR          test.client.domain.\n242                     IN PTR          test2.client.domain.\n245                     IN PTR          test5.client.domain.\n<\/code><\/pre>\n
\nE no named.conf<\/b> adicionamos a descri\u00e7\u00e3o do nosso novo arquivo:<\/p>\n
zone \"255-240.9.8.7.in-addr.arpa.\" IN {\n        type master;\n        file \"master\/255-240.9.8.7.in-addr.arpa\";\n};<\/code><\/pre>\n
\nReiniciamos o processo do BIND.<\/p>\n
\/etc\/init.d\/named restart<\/code><\/pre>\n
\nPronto. Agora podemos verificar.<\/p>\n
#>  host 7.8.9.245 \n245.9.8.7.in-addr.arpa is an alias for 245.255-240.9.8.7.in-addr.arpa.\n245.255-240.9.8.7.in-addr.arpa domain name pointer test5.client.domain.<\/code><\/pre>\n
\nObserve que n\u00e3o apenas o registro PTR \u00e9 devolvido, mas tamb\u00e9m o CNAME. Isso \u00e9 esperado. Se voc\u00ea est\u00e1 curioso sobre o motivo, continue para o pr\u00f3ximo cap\u00edtulo.<\/p>\n
2. Teoria. Como isso funciona.<\/b><\/p>\n
\u00c9 complicado configurar e depurar uma caixa-preta. \u00c9 muito mais f\u00e1cil se voc\u00ea entender o que acontece por dentro.<\/p>\n
Quando delegamos um subdom\u00ednio em um dom\u00ednio dom\u00ednio<\/b>, escrevemos algo como isto:<\/p>\n
client.domain.\tNS\tns1.client.domain.\nns1.client.domain.\tA\t7.8.7.8<\/code><\/pre>\n
\nDizemos a todos que perguntam que n\u00e3o respondemos por esta zona e dizemos quem responde. E todos os pedidos para client.domain<\/b> s\u00e3o redirecionados para 7.8.7.8. Ao verificar, vemos a seguinte situa\u00e7\u00e3o (deixemos de lado o que est\u00e1 com o cliente, isso n\u00e3o \u00e9 importante):<\/p>\n
# host test.client.domain\ntest.client.domain has address 7.8.9.241<\/code><\/pre>\n
\nOu seja, fomos informados de que existe um registro A e seu IP \u00e9 7.8.9.241. Nenhuma informa\u00e7\u00e3o adicional.<\/p>\n
E como posso fazer o mesmo com a sub-rede?<\/b><\/p>\n
Como nosso servidor DNS est\u00e1 registrado no RIPE, ao solicitar um registro PTR para o endere\u00e7o IP da nossa rede, o primeiro pedido ainda ser\u00e1 para n\u00f3s. A l\u00f3gica \u00e9 a mesma que para dom\u00ednios. Mas como incluir a sub-rede no arquivo da zona?<\/p>\n
Tentamos escrever assim:<\/p>\n
255-240  IN  NS      7.8.7.8<\/code><\/pre>\n
\nE\u2026 o milagre n\u00e3o aconteceu. N\u00e3o estamos recebendo nenhum redirecionamento da solicita\u00e7\u00e3o. A quest\u00e3o \u00e9 que o bind n\u00e3o sabe que essas entradas no arquivo de zona reversa s\u00e3o endere\u00e7os IP e, muito menos, entende a entrada de intervalo. Para ele, isso \u00e9 apenas um subdom\u00ednio simb\u00f3lico. Ou seja, para o bind n\u00e3o haver\u00e1 diferen\u00e7a entre «255-240<\/b>\u201d e \u201coursuperclient<\/b>«. E para que a solicita\u00e7\u00e3o seja direcionada corretamente, o endere\u00e7o na solicita\u00e7\u00e3o deve ser assim: 241.255-240.9.8.7.in-addr.arpa<\/b>. Ou assim, se usarmos um subdom\u00ednio simb\u00f3lico: 241.oursuperclient.9.8.7.in-addr.arpa<\/b>. Isso \u00e9 diferente do normal: 241.9.8.7.in-addr.arpa<\/b>.<\/p>\n
Fazer tal pedido manualmente ser\u00e1 problem\u00e1tico. E mesmo que funcione, ainda n\u00e3o est\u00e1 claro como aplicar isso na vida real. Pois, ao solicitar, 7.8.9.241<\/b> ainda recebemos resposta do DNS do provedor, e n\u00e3o do cliente.<\/p>\n
E aqui \u00e9 onde entra em cena CNAME<\/b>.<\/p>\n
Do lado do provedor, \u00e9 necess\u00e1rio fazer um alias para todos os endere\u00e7os IP da sub-rede em um formato que redirecione a solicita\u00e7\u00e3o ao DNS do cliente.<\/p>\n
255-240  IN  NS      ns1.client.domain.\n241     IN  CNAME   241.255-240\n242     IN  CNAME   242.255-240\netc.\n<\/code><\/pre>\n
\nIsso \u00e9 para os trabalhadores =). <\/p>\n
E para os pregui\u00e7osos, a constru\u00e7\u00e3o abaixo \u00e9 mais adequada:<\/p>\n
255-240  IN  NS      ns1.client.domain.\n$GENERATE 240-255 $ CNAME $.255-240<\/code><\/pre>\n
\nAgora a solicita\u00e7\u00e3o de informa\u00e7\u00f5es para o endere\u00e7o 7.8.9.241<\/b> do 241.9.8.7.in-addr.arpa<\/b> no servidor DNS do provedor ser\u00e1 transformada em 241.255-240.9.8.7.in-addr.arpa<\/b> e ser\u00e1 enviada ao DNS do cliente. <\/p>\n
Do lado do cliente, ser\u00e1 necess\u00e1rio processar tais pedidos. Assim, criamos uma zona 255-240.9.8.7.in-addr.arpa<\/b>. Nela, basicamente, podemos colocar registros reversos para quaisquer IPs de toda a sub-rede \/24, mas apenas nos perguntar\u00e3o sobre aqueles que o provedor nos redirecionar, ent\u00e3o n\u00e3o podemos brincar muito =).
\nPara ilustrar, mais uma vez trago um exemplo do conte\u00fado do arquivo da zona reversa do lado do cliente:<\/p>\n
$ORIGIN 255-240.9.8.7.in-addr.arpa.\n$TTL 1W\n@                       1D IN SOA       ns1.client.domain. root.client.domain. (\n                        2008152607      ; serial\n                        3H              ; refresh\n                        15M             ; retry\n                        1W              ; expiry\n                        1D )            ; minimum\n@                       IN NS        ns1.client.domain.\n@                       IN NS        ns2.client.domain.\n241                     IN PTR          test.client.domain.\n242                     IN PTR          test2.client.domain.\n245                     IN PTR          test5.client.domain.\n<\/code><\/pre>\n
\n\u00c9 por isso que, do lado do provedor, usamos CNAME, e recebemos em resposta \u00e0 solicita\u00e7\u00e3o de dados por endere\u00e7o IP<\/a> duas entradas, e n\u00e3o uma.<\/p>\n
#>  host 7.8.9.245 \n245.9.8.7.in-addr.arpa is an alias for 245.255-240.9.8.7.in-addr.arpa.\n245.255-240.9.8.7.in-addr.arpa domain name pointer test5.client.domain.<\/code><\/pre>\n
\nE n\u00e3o se esque\u00e7a de configurar corretamente o ACL. Porque \u00e9 in\u00fatil pegar a zona PTR e n\u00e3o responder a ningu\u00e9m do lado externo =).<\/b><\/i>
\n
Fonte: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0441\u0442\u0430\u043b\u0430 \u043e\u0434\u043d\u0430\u0436\u0434\u044b \u043f\u0435\u0440\u0435\u0434\u043e \u043c\u043d\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0430, \u043e\u0442\u0434\u0430\u0442\u044c \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0430\u0432\u043e \u043d\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 PTR-\u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043e\u0442\u0434\u0430\u043d\u043d\u043e\u0439 \u0435\u043c\u0443 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/28. \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a BIND \u0438\u0437\u0432\u043d\u0435 \u0443 \u043c\u0435\u043d\u044f \u043d\u0435\u0442. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0440\u0435\u0448\u0438\u043b \u043f\u043e\u0439\u0442\u0438 \u0434\u0440\u0443\u0433\u0438\u043c \u043f\u0443\u0442\u0435\u043c \u2014 \u0434\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043b\u0438\u0435\u043d\u0442\u0443 \u043a\u0443\u0441\u043e\u043a PTR-\u0437\u043e\u043d\u044b \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/24. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b \u2014 \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0449\u0435? \u041f\u0440\u043e\u0441\u0442\u043e \u043d\u0443\u0436\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043f\u0440\u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c \u043f\u043e\u0434\u0441\u0435\u0442\u044c \u0438 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c \u043d\u0430 \u043d\u0443\u0436\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33717","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Delega\u00e7\u00e3o da zona reversa de subnet menor que \/24 no BIND. Como funciona | ProHoster","description":"Certa vez, surgiu a tarefa de conceder a um dos clientes o direito de editar os registros PTR da subnet \/28 que lhe foi atribu\u00edda. N\u00e3o tenho automa\u00e7\u00e3o para editar as configura\u00e7\u00f5es do BIND externamente.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0437\u043e\u043d\u044b \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u043c\u0435\u043d\u0435\u0435 \/24 \u0432 BIND. \u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 | ProHoster","og:description":"\u0412\u0441\u0442\u0430\u043b\u0430 \u043e\u0434\u043d\u0430\u0436\u0434\u044b \u043f\u0435\u0440\u0435\u0434\u043e \u043c\u043d\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0430, \u043e\u0442\u0434\u0430\u0442\u044c \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0430\u0432\u043e \u043d\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 PTR-\u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043e\u0442\u0434\u0430\u043d\u043d\u043e\u0439 \u0435\u043c\u0443 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/28. \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a BIND \u0438\u0437\u0432\u043d\u0435 \u0443 \u043c\u0435\u043d\u044f \u043d\u0435\u0442.","og:url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:20+00:00","article:modified_time":"2019-10-31T18:54:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33717","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:27:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:35:31","updated":"2026-02-08 20:27:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/33717","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=33717"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/33717\/revisions"}],"predecessor-version":[{"id":157777,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/33717\/revisions\/157777"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=33717"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=33717"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=33717"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}