{"id":33717,"date":"2019-10-31T21:54:20","date_gmt":"2019-10-31T18:54:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet\/"},"modified":"2019-10-31T21:54:20","modified_gmt":"2019-10-31T18:54:20","slug":"delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","title":{"rendered":"Delegarea zonei inverse pentru subre\u021bele mai mici de \/24 \u00een BIND. Cum func\u021bioneaz\u0103","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

O dat\u0103, am avut de rezolvat sarcina de a oferi unui client dreptul de a edita \u00eenregistr\u0103rile PTR ale subre\u021belei \/28. Nu am automatizare pentru a edita set\u0103rile BIND din exterior. De aceea, am decis s\u0103 urmez o alt\u0103 cale \u2014 s\u0103 deleg clientului o parte din zona PTR a subre\u021belei \/24.<\/p>\n

Ar p\u0103rea \u2014 ce poate fi mai simplu? Pur \u0219i simplu definim subre\u021beaua corespunz\u0103toare \u0219i o direc\u021bion\u0103m c\u0103tre NS-ul dorit, a\u0219a cum se face cu un subdomeniu. Dar nu este deloc a\u0219a. Lucrurile nu sunt chiar at\u00e2t de simple (de\u0219i, \u00een realitate, sunt foarte elementare, dar intui\u021bia nu ajut\u0103), motiv pentru care scriu acest articol.<\/p>\n

Cine dore\u0219te s\u0103 se descurce singur, poate citi. RFC<\/a><\/noindex>
\nCine vrea o solu\u021bie gata f\u0103cut\u0103, bun venit mai departe.
\n<\/a><\/noindex>
\nPentru a nu \u00eent\u00e2rzia pe cei care iubesc metoda copierea \u0219i lipirea, voi prezenta mai \u00eent\u00e2i partea practic\u0103, iar dup\u0103 aceea teoria.<\/p>\n

1. Practic\u0103. Deleg\u0103m zona \/28.<\/b><\/p>\n

S\u0103 presupunem c\u0103 avem o subre\u021bea. 7.8.9.0\/24<\/b>. Trebuie s\u0103 deleg\u0103m subre\u021beaua. 7.8.9.240\/28<\/b> c\u0103tre clientul DNS. 7.8.7.8<\/b> (ns1.client.domain.<\/b>).<\/p>\n

Pe DNS-ul furnizorului, trebuie s\u0103 g\u0103sim fi\u0219ierul care descrie zona invers\u0103 a acestei subre\u021bele. S\u0103 fie. 9.8.7.in-addr.arpa.<\/b>.
\nComent\u0103m \u00eenregistr\u0103rile de la 240 la 255, dac\u0103 exist\u0103. \u0218i la finalul fi\u0219ierului scriem urm\u0103toarele:<\/p>\n

255-240  IN  NS      7.8.7.8\n$GENERATE 240-255 $ CNAME $.255-240<\/code><\/pre>\n
\nnu uit\u0103m s\u0103 cre\u0219tem serialul zonei \u0219i facem <\/p>\n
rndc reload.<\/code><\/pre>\n
\nAici se termin\u0103 partea furnizorului. Trecem la DNS-ul clientului.<\/p>\n
\u00cen primul r\u00e2nd, cre\u0103m fi\u0219ierul. \/etc\/bind\/master\/255-240.9.8.7.in-addr.arpa<\/b> users.module.ts<\/p>\n
$ORIGIN 255-240.9.8.7.in-addr.arpa.\n$TTL 1W\n@                       1D IN SOA       ns1.client.domain. root.client.domain. (\n                        2008152607      ; serial\n                        3H              ; refresh\n                        15M             ; retry\n                        1W              ; expiry\n                        1D )            ; minimum\n@                       IN NS        ns1.client.domain.\n@                       IN NS        ns2.client.domain.\n241                     IN PTR          test.client.domain.\n242                     IN PTR          test2.client.domain.\n245                     IN PTR          test5.client.domain.\n<\/code><\/pre>\n
\n\u0218i \u00een named.conf,<\/b> ad\u0103ug\u0103m descrierea noului nostru fi\u0219ier:<\/p>\n
zone \"255-240.9.8.7.in-addr.arpa.\" IN {\n        type master;\n        file \"master\/255-240.9.8.7.in-addr.arpa\";\n};<\/code><\/pre>\n
\nB, repornim procesul bind.<\/p>\n
\/etc\/init.d\/named restart<\/code><\/pre>\n
\nTotul. Acum putem verifica.<\/p>\n
#>  host 7.8.9.245 \n245.9.8.7.in-addr.arpa is an alias for 245.255-240.9.8.7.in-addr.arpa.\n245.255-240.9.8.7.in-addr.arpa domain name pointer test5.client.domain.<\/code><\/pre>\n
\nRe\u021bine\u021bi c\u0103 nu se returneaz\u0103 doar \u00eenregistrarea PTR, ci \u0219i CNAME. A\u0219a trebuie s\u0103 fie. Dac\u0103 sunte\u021bi curios de ce, bine a\u021bi venit \u00een urm\u0103torul capitol.<\/p>\n
2. Teorie. Cum func\u021bioneaz\u0103 aceasta.<\/b><\/p>\n
Este dificil de configurat \u0219i depanat o cutie neagr\u0103. Este mult mai simplu dac\u0103 \u00een\u021belegi ce se \u00eent\u00e2mpl\u0103 \u00een interior.<\/p>\n
C\u00e2nd deleg\u0103m un subdomeniu \u00een domeniu, domain<\/b>, scriem ceva de genul acesta:<\/p>\n
client.domain.\tNS\tns1.client.domain.\nns1.client.domain.\tA\t7.8.7.8<\/code><\/pre>\n
\nSpunem tuturor celor care \u00eentreab\u0103 c\u0103 pentru acest domeniu nu r\u0103spundem \u0219i indic\u0103m cine r\u0103spunde. \u0218i toate cererile la client.domain<\/b> sunt redirec\u021bionate c\u0103tre 7.8.7.8. La verificare, vedem urm\u0103toarea situa\u021bie (s\u0103 l\u0103s\u0103m deoparte ce are clientul, nu este relevant):<\/p>\n
# host test.client.domain\ntest.client.domain has address 7.8.9.241<\/code><\/pre>\n
\nAdic\u0103, ni s-a comunicat c\u0103 exist\u0103 un astfel de \u00eenregistrare A \u0219i IP-ul ei este 7.8.9.241. Nicio informa\u021bie suplimentar\u0103.<\/p>\n
Dar cum poate fi realizat acela\u0219i lucru cu un subnet?<\/b><\/p>\n
Deoarece serverul nostru DNS este \u00eenregistrat \u00een RIPE, atunci c\u00e2nd solicit\u0103m \u00eenregistrarea PTR a unei adrese IP din re\u021beaua noastr\u0103, prima solicitare va fi oricum c\u0103tre noi. Logica este aceea\u0219i ca \u0219i pentru domenii. Dar cum se poate introduce subnetul \u00een fi\u0219ierul zonei?<\/p>\n
\u00cencerc\u0103m s\u0103-l introducem astfel:<\/p>\n
255-240  IN  NS      7.8.7.8<\/code><\/pre>\n
\n\u0218i... minunea nu s-a \u00eent\u00e2mplat. Nu primim nicio redirec\u021bionare a cererii. Problema este c\u0103 bind nu are nici cea mai mic\u0103 idee c\u0103 aceste \u00eenregistr\u0103ri din fi\u0219ierul zonei inverse sunt adrese IP \u0219i cu at\u00e2t mai pu\u021bin \u00een\u021belege \u00eenregistrarea intervalului. Pentru el, aceasta este pur \u0219i simplu un subdomeniu simbolic. Asta \u00eenseamn\u0103 c\u0103 pentru bind nu va fi nicio diferen\u021b\u0103 \u00eentre \u201e255-240<\/b>» \u0219i «oursuperclient<\/b>\u201e. \u0218i pentru ca cererea s\u0103 ajung\u0103 unde trebuie, adresa din cerere trebuie s\u0103 arate a\u0219a: 241.255-240.9.8.7.in-addr.arpa<\/b>. Sau astfel, dac\u0103 folosim un subdomeniu simbolic: 241.oursuperclient.9.8.7.in-addr.arpa<\/b>. Aceasta difer\u0103 de obiceiul: 241.9.8.7.in-addr.arpa<\/b>.<\/p>\n
Este problematic s\u0103 realiz\u0103m o astfel de cerere manual. Iar dac\u0103 o vom reu\u0219i, tot nu este clar cum poate fi aplicat\u0103 \u00een via\u021ba real\u0103. Ca urmare a cererii 7.8.9.241<\/b> \u00eenc\u0103 ne r\u0103spunde DNS-ul furnizorului, nu cel al clientului.<\/p>\n
Aici, \u00eencep s\u0103 \u00ee\u0219i fac\u0103 sim\u021bit\u0103 prezen\u021ba CNAME<\/b>.<\/p>\n
Pe partea furnizorului, trebuie s\u0103 fie creat un alias pentru toate adresele IP ale subnetului \u00eentr-un format care va redirec\u021biona cererea c\u0103tre DNS-ul clientului.<\/p>\n
255-240  IN  NS      ns1.client.domain.\n241     IN  CNAME   241.255-240\n242     IN  CNAME   242.255-240\n\u0219i a\u0219a mai departe.\n<\/code><\/pre>\n
\nAcestea sunt pentru cei harnici =). <\/p>\n
Iar pentru cei mai lene\u0219i, constructul de mai jos se potrive\u0219te mai bine:<\/p>\n
255-240  IN  NS      ns1.client.domain.\n$GENERATE 240-255 $ CNAME $.255-240<\/code><\/pre>\n
\nAcum, cererea de informa\u021bii pentru adresa 7.8.9.241<\/b> din 241.9.8.7.in-addr.arpa<\/b> pe serverul DNS al furnizorului va fi transformat\u0103 \u00een 241.255-240.9.8.7.in-addr.arpa<\/b> \u0219i se va direc\u021biona c\u0103tre DNS-ul clientului. <\/p>\n
Din partea clientului, va trebui s\u0103 gestion\u0103m astfel de cereri. Prin urmare, cre\u0103m zona 255-240.9.8.7.in-addr.arpa<\/b>. \u00cen ea, \u00een principiu, putem plasa \u00eenregistr\u0103ri inverse pentru orice IP din \u00eentreaga subnet\u0103 \/24, dar ne vor \u00eentreba doar despre cele pe care furnizorul ni le va redirec\u021biona, a\u0219a c\u0103 nu ne putem juca =).
\nPentru a ilustra, voi aduce din nou un exemplu al con\u021binutului fi\u0219ierului zonei inverse din partea clientului:<\/p>\n
$ORIGIN 255-240.9.8.7.in-addr.arpa.\n$TTL 1W\n@                       1D IN SOA       ns1.client.domain. root.client.domain. (\n                        2008152607      ; serial\n                        3H              ; refresh\n                        15M             ; retry\n                        1W              ; expiry\n                        1D )            ; minimum\n@                       IN NS        ns1.client.domain.\n@                       IN NS        ns2.client.domain.\n241                     IN PTR          test.client.domain.\n242                     IN PTR          test2.client.domain.\n245                     IN PTR          test5.client.domain.\n<\/code><\/pre>\n
\nDeoarece folosim CNAME din partea furnizorului, primim ca r\u0103spuns datele pentru adres\u0103 IP<\/a> dou\u0103 \u00eenregistr\u0103ri, nu una.<\/p>\n
#>  host 7.8.9.245 \n245.9.8.7.in-addr.arpa is an alias for 245.255-240.9.8.7.in-addr.arpa.\n245.255-240.9.8.7.in-addr.arpa domain name pointer test5.client.domain.<\/code><\/pre>\n
\n\u0218i nu uita\u021bi s\u0103 configura\u021bi corect ACL. Este inutil s\u0103 prelua\u021bi zona PTR \u0219i s\u0103 nu r\u0103spunde\u021bi nim\u0103nui din exterior =).<\/b><\/i>
\n
Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0441\u0442\u0430\u043b\u0430 \u043e\u0434\u043d\u0430\u0436\u0434\u044b \u043f\u0435\u0440\u0435\u0434\u043e \u043c\u043d\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0430, \u043e\u0442\u0434\u0430\u0442\u044c \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0430\u0432\u043e \u043d\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 PTR-\u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043e\u0442\u0434\u0430\u043d\u043d\u043e\u0439 \u0435\u043c\u0443 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/28. \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a BIND \u0438\u0437\u0432\u043d\u0435 \u0443 \u043c\u0435\u043d\u044f \u043d\u0435\u0442. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0440\u0435\u0448\u0438\u043b \u043f\u043e\u0439\u0442\u0438 \u0434\u0440\u0443\u0433\u0438\u043c \u043f\u0443\u0442\u0435\u043c \u2014 \u0434\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043b\u0438\u0435\u043d\u0442\u0443 \u043a\u0443\u0441\u043e\u043a PTR-\u0437\u043e\u043d\u044b \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/24. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b \u2014 \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0449\u0435? \u041f\u0440\u043e\u0441\u0442\u043e \u043d\u0443\u0436\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043f\u0440\u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c \u043f\u043e\u0434\u0441\u0435\u0442\u044c \u0438 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c \u043d\u0430 \u043d\u0443\u0436\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33717","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Delegarea zonei inverse pentru subneturi mai mici de \/24 \u00een BIND. Cum func\u021bioneaz\u0103 | ProHoster","description":"Odat\u0103 m-am confruntat cu sarcina de a oferi unuia dintre clien\u021bi dreptul de a edita \u00eenregistr\u0103rile PTR pentru subnetul s\u0103u \/28. Nu am automatizare pentru editarea set\u0103rilor BIND din exterior.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0437\u043e\u043d\u044b \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u043c\u0435\u043d\u0435\u0435 \/24 \u0432 BIND. \u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 | ProHoster","og:description":"\u0412\u0441\u0442\u0430\u043b\u0430 \u043e\u0434\u043d\u0430\u0436\u0434\u044b \u043f\u0435\u0440\u0435\u0434\u043e \u043c\u043d\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0430, \u043e\u0442\u0434\u0430\u0442\u044c \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0430\u0432\u043e \u043d\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 PTR-\u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043e\u0442\u0434\u0430\u043d\u043d\u043e\u0439 \u0435\u043c\u0443 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/28. \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a BIND \u0438\u0437\u0432\u043d\u0435 \u0443 \u043c\u0435\u043d\u044f \u043d\u0435\u0442.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:20+00:00","article:modified_time":"2019-10-31T18:54:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33717","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:27:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:35:31","updated":"2026-02-08 20:27:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/33717","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=33717"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/33717\/revisions"}],"predecessor-version":[{"id":157777,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/33717\/revisions\/157777"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=33717"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=33717"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=33717"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}