{"id":33717,"date":"2019-10-31T21:54:20","date_gmt":"2019-10-31T18:54:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet\/"},"modified":"2019-10-31T21:54:20","modified_gmt":"2019-10-31T18:54:20","slug":"delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","title":{"rendered":"Delegovanie sp\u00e4tn\u00fdch z\u00f3n podsiete menej ako \/24 v BIND. Ako to funguje","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jedn\u00e9ho d\u0148a pred mnou st\u00e1la \u00faloha, odovzda\u0165 jedn\u00e9mu z klientov pr\u00e1vo na \u00fapravu PTR z\u00e1znamov pridelen\u00e9ho jej podsiete \/28. Nem\u00e1m automatiz\u00e1ciu na \u00fapravu nastaven\u00ed BIND zvonka. Preto som sa rozhodol \u00eds\u0165 inou cestou \u2013 delegova\u0165 klientovi kus PTR z\u00f3ny podsiete \/24.<\/p>\n

Niekto by si pomyslel \u2013 \u010do m\u00f4\u017ee by\u0165 jednoduch\u0161ie? Sta\u010d\u00ed spr\u00e1vne nastavi\u0165 podsie\u0165 a smerova\u0165 na po\u017eadovan\u00fd NS, ako to rob\u00edme s subdom\u00e9nou. Ale nie. Nie je to tak\u00e9 jednoduch\u00e9 (aj ke\u010f v skuto\u010dnosti je to \u00faplne primit\u00edvne, ale intu\u00edcia nepom\u00f4\u017ee), preto p\u00ed\u0161em tento \u010dl\u00e1nok.<\/p>\n

Kto chce s\u00e1m pochopi\u0165, m\u00f4\u017ee si pre\u010d\u00edta\u0165 RFC<\/a><\/noindex>
\nKto chce hotov\u00e9 rie\u0161enie, vitajte pod kat.
\n<\/a><\/noindex>
\nAby som nezdr\u017eoval t\u00fdch, ktor\u00ed maj\u00fa radi met\u00f3du kop\u00edrovania a vkladania, najsk\u00f4r zverejn\u00edm praktick\u00fa \u010das\u0165, a po nej teoretick\u00fa.<\/p>\n

1. Prax. Delegujeme z\u00f3nu \/28<\/b><\/p>\n

Predpokladajme, \u017ee m\u00e1me podsie\u0165 7.8.9.0\/24<\/b>. Mus\u00edme delegova\u0165 podsie\u0165 7.8.9.240\/28<\/b> na DNS klienta 7.8.7.8<\/b> (ns1.client.domain<\/b>).<\/p>\n

Na providerovom DNS je potrebn\u00e9 n\u00e1js\u0165 s\u00fabor, ktor\u00fd popisuje sp\u00e4tn\u00fa z\u00f3nu tejto podsiete. Nech je to 9.8.7.in-addr.arpa<\/b>.
\nZ\u00e1znamy od 240 do 255 komentujeme, ak existuj\u00fa. A na koniec s\u00faboru p\u00ed\u0161eme nasleduj\u00face:<\/p>\n

255-240  IN  NS      7.8.7.8\n$GENERATE 240-255 $ CNAME $.255-240<\/code><\/pre>\n
\nnezab\u00fadame zv\u00fd\u0161i\u0165 serial z\u00f3ny a vykon\u00e1me <\/p>\n
rndc reload<\/code><\/pre>\n
\nNa tom je providerova \u010das\u0165 skon\u010den\u00e1. Prech\u00e1dzame k klientsk\u00e9mu DNS.<\/p>\n
Najsk\u00f4r vytvor\u00edme s\u00fabor \/etc\/bind\/master\/255-240.9.8.7.in-addr.arpa<\/b> nasleduj\u00faceho obsahu:<\/p>\n
$ORIGIN 255-240.9.8.7.in-addr.arpa.\n$TTL 1W\n@                       1D IN SOA       ns1.client.domain. root.client.domain. (\n                        2008152607      ; serial\n                        3H              ; refresh\n                        15M             ; retry\n                        1W              ; expiry\n                        1D )            ; minimum\n@                       IN NS        ns1.client.domain.\n@                       IN NS        ns2.client.domain.\n241                     IN PTR          test.client.domain.\n242                     IN PTR          test2.client.domain.\n245                     IN PTR          test5.client.domain.\n<\/code><\/pre>\n
\nA v named.conf<\/b> dop\u00ed\u0161eme popis n\u00e1\u0161ho nov\u00e9ho s\u00faboru:<\/p>\n
zone \"255-240.9.8.7.in-addr.arpa.\" IN {\n        type master;\n        file \"master\/255-240.9.8.7.in-addr.arpa\";\n};<\/code><\/pre>\n
\nB re\u0161tartujeme proces bind.<\/p>\n
\/etc\/init.d\/named restart<\/code><\/pre>\n
\nV\u0161etko. Teraz m\u00f4\u017eeme kontrolova\u0165.<\/p>\n
#>  host 7.8.9.245 \n245.9.8.7.in-addr.arpa is an alias for 245.255-240.9.8.7.in-addr.arpa.\n245.255-240.9.8.7.in-addr.arpa domain name pointer test5.client.domain.<\/code><\/pre>\n
\nV\u0161imnite si, \u017ee sa odovzd\u00e1va nielen PTR z\u00e1znam, ale aj CNAME. Tak to m\u00e1 by\u0165. Ak v\u00e1s zauj\u00edma pre\u010do, vitajte v \u010fal\u0161ej kapitole.<\/p>\n
2. Te\u00f3ria. Ako to funguje.<\/b><\/p>\n
Je \u0165a\u017ek\u00e9 nastavi\u0165 a ladenie \u010dierneho boxu. Je to ove\u013ea jednoduch\u0161ie, ak ch\u00e1pete, \u010do sa deje vo vn\u00fatri.<\/p>\n
Ke\u010f delegujeme subdom\u00e9nu v dom\u00e9ne domain<\/b>, p\u00ed\u0161eme nie\u010do tak\u00e9to:<\/p>\n
client.domain.\tNS\tns1.client.domain.\nns1.client.domain.\tA\t7.8.7.8<\/code><\/pre>\n
\nPovieme v\u0161etk\u00fdm, ktor\u00ed sa p\u00fdtaj\u00fa, \u017ee za tento segment nezodpoved\u00e1me a povieme, kto zodpoved\u00e1. A v\u0161etky \u017eiadosti sa client.domain<\/b> preposielaj\u00fa na 7.8.7.8. Pri kontrole vid\u00edme nasleduj\u00faci obraz (vynechajme to, \u010do m\u00e1 klient, je to nepodstatn\u00e9):<\/p>\n
# host test.client.domain\ntest.client.domain has address 7.8.9.241<\/code><\/pre>\n
\nT.j. dostali sme inform\u00e1ciu, \u017ee existuje tak\u00fd z\u00e1znam A a jeho IP 7.8.9.241. \u017diadne \u010fal\u0161ie inform\u00e1cie.<\/p>\n
A ako to ist\u00e9 m\u00f4\u017eeme spravi\u0165 s podsie\u0165ou?<\/b><\/p>\n
Ke\u010f\u017ee n\u00e1\u0161 DNS server je zaregistrovan\u00fd v RIPE, pri po\u017eiadavke PTR na IP adresu z na\u0161ej siete, prv\u00fd po\u017eiadavok bude aj tak smerova\u0165 k n\u00e1m. Logika je rovnak\u00e1 ako pri dom\u00e9nach. Len\u017ee ako zap\u00edsa\u0165 podsie\u0165 do z\u00f3nov\u00e9ho s\u00faboru?<\/p>\n
Pok\u00fa\u0161ame sa zap\u00edsa\u0165 to takto:<\/p>\n
255-240  IN  NS      7.8.7.8<\/code><\/pre>\n
\nA... nothing miraculous happened. We are not receiving any redirection of the request. The thing is, bind is not even aware that these entries in the reverse zone file are IP addresses, and even less understands the range record. For it, this is simply a symbolic subdomain. That is, for bind, there will be no difference between \"255-240<\/b>» a «oursuperclient<\/b>\". And for the request to go where it needs to, the address in the request must look like this: 241.255-240.9.8.7.in-addr.arpa<\/b>. Alebo takto, ak pou\u017e\u00edvame symbolick\u00fd subdom\u00e9n: 241.oursuperclient.9.8.7.in-addr.arpa<\/b>. To sa l\u00ed\u0161i od be\u017en\u00e9ho: 241.9.8.7.in-addr.arpa<\/b>.<\/p>\n
Ru\u010dne by bolo \u0165a\u017ek\u00e9 tak\u00fato po\u017eiadavku splni\u0165. A aj keby sa podarilo, aj tak nie je jasn\u00e9, ako to uplatni\u0165 v re\u00e1lnom \u017eivote. Ve\u010f na po\u017eiadavku 7.8.9.241<\/b> n\u00e1m na\u010falej odpoved\u00e1 poskytovate\u013esk\u00fd DNS, nie klientsk\u00fd.<\/p>\n
A tu prich\u00e1dzaj\u00fa do hry CNAME<\/b>.<\/p>\n
Na strane poskytovate\u013ea je potrebn\u00e9 vytvori\u0165 alias pre v\u0161etky IP adresy podsiete v form\u00e1te, ktor\u00fd presmeruje po\u017eiadavku klientsk\u00e9mu DNS.<\/p>\n
255-240  IN  NS      ns1.client.domain.\n241     IN  CNAME   241.255-240\n242     IN  CNAME   242.255-240\nat\u010f.\n<\/code><\/pre>\n
\nTo je pre pracovit\u00fdch =). <\/p>\n
A pre leniv\u00fdch sa viac hod\u00ed nasleduj\u00faca kon\u0161trukcia:<\/p>\n
255-240  IN  NS      ns1.client.domain.\n$GENERATE 240-255 $ CNAME $.255-240<\/code><\/pre>\n
\nTeraz po\u017eiadavka na inform\u00e1cie o adrese 7.8.9.241<\/b> z 241.9.8.7.in-addr.arpa<\/b> na DNS serveri poskytovate\u013ea bude pretransformovan\u00e1 na 241.255-240.9.8.7.in-addr.arpa<\/b> a po\u0161le sa na DNS klienta. <\/p>\n
Na strane klienta bude potrebn\u00e9 spracov\u00e1va\u0165 tak\u00e9to po\u017eiadavky. Pod\u013ea toho vytvor\u00edme z\u00f3nu 255-240.9.8.7.in-addr.arpa<\/b>. V nej m\u00f4\u017eeme v podstate umiestni\u0165 reverzn\u00e9 z\u00e1znamy pre ak\u00e9ko\u013evek IP celej podsiete \/24, ale p\u00fdta\u0165 sa n\u00e1s bud\u00fa len na tie, ktor\u00e9 k n\u00e1m poskytovate\u013e preposiela, tak\u017ee nebude mo\u017en\u00e9 sa s t\u00fdm moc zdr\u017ea\u0165 =).
\nPre ilustr\u00e1ciu e\u0161te raz uvediem pr\u00edklad obsahu s\u00faboru reverznej z\u00f3ny na strane klienta:<\/p>\n
$ORIGIN 255-240.9.8.7.in-addr.arpa.\n$TTL 1W\n@                       1D IN SOA       ns1.client.domain. root.client.domain. (\n                        2008152607      ; serial\n                        3H              ; refresh\n                        15M             ; retry\n                        1W              ; expiry\n                        1D )            ; minimum\n@                       IN NS        ns1.client.domain.\n@                       IN NS        ns2.client.domain.\n241                     IN PTR          test.client.domain.\n242                     IN PTR          test2.client.domain.\n245                     IN PTR          test5.client.domain.\n<\/code><\/pre>\n
\nPreto\u017ee na strane poskytovate\u013ea pou\u017e\u00edvame CNAME, dost\u00e1vame v odpovedi na po\u017eiadavok \u00fadajov o IP adrese<\/a> dvoch z\u00e1znamoch, nie jednom.<\/p>\n
#>  host 7.8.9.245 \n245.9.8.7.in-addr.arpa is an alias for 245.255-240.9.8.7.in-addr.arpa.\n245.255-240.9.8.7.in-addr.arpa domain name pointer test5.client.domain.<\/code><\/pre>\n
\nA nezabudnite spr\u00e1vne nastavi\u0165 ACL. Preto\u017ee nem\u00e1 zmysel si vzia\u0165 PTR z\u00f3nu a neodpoveda\u0165 nikomu z vonku =).<\/b><\/i>
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0441\u0442\u0430\u043b\u0430 \u043e\u0434\u043d\u0430\u0436\u0434\u044b \u043f\u0435\u0440\u0435\u0434\u043e \u043c\u043d\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0430, \u043e\u0442\u0434\u0430\u0442\u044c \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0430\u0432\u043e \u043d\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 PTR-\u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043e\u0442\u0434\u0430\u043d\u043d\u043e\u0439 \u0435\u043c\u0443 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/28. \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a BIND \u0438\u0437\u0432\u043d\u0435 \u0443 \u043c\u0435\u043d\u044f \u043d\u0435\u0442. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0440\u0435\u0448\u0438\u043b \u043f\u043e\u0439\u0442\u0438 \u0434\u0440\u0443\u0433\u0438\u043c \u043f\u0443\u0442\u0435\u043c \u2014 \u0434\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043b\u0438\u0435\u043d\u0442\u0443 \u043a\u0443\u0441\u043e\u043a PTR-\u0437\u043e\u043d\u044b \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/24. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b \u2014 \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0449\u0435? \u041f\u0440\u043e\u0441\u0442\u043e \u043d\u0443\u0436\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043f\u0440\u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c \u043f\u043e\u0434\u0441\u0435\u0442\u044c \u0438 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c \u043d\u0430 \u043d\u0443\u0436\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33717","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Delegovanie \u043e\u0431\u0440\u0430\u0442nej z\u00f3ny \u043f\u043e\u0434\u0441\u0435\u0442\u0438 menej ako \/24 v BIND. Ako to funguje | ProHoster","description":"Jedn\u00e9ho d\u0148a som \u010delil \u00falohe prenecha\u0165 jedn\u00e9ho z klientov pr\u00e1vo na \u00fapravu PTR z\u00e1znamov zverenej mu podsiete \/28. Nem\u00e1m automatiz\u00e1ciu na \u00fapravu nastaven\u00ed BIND z vonkaj\u0161ka.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0437\u043e\u043d\u044b \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u043c\u0435\u043d\u0435\u0435 \/24 \u0432 BIND. \u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 | ProHoster","og:description":"\u0412\u0441\u0442\u0430\u043b\u0430 \u043e\u0434\u043d\u0430\u0436\u0434\u044b \u043f\u0435\u0440\u0435\u0434\u043e \u043c\u043d\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0430, \u043e\u0442\u0434\u0430\u0442\u044c \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0430\u0432\u043e \u043d\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 PTR-\u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043e\u0442\u0434\u0430\u043d\u043d\u043e\u0439 \u0435\u043c\u0443 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/28. \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a BIND \u0438\u0437\u0432\u043d\u0435 \u0443 \u043c\u0435\u043d\u044f \u043d\u0435\u0442.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:20+00:00","article:modified_time":"2019-10-31T18:54:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33717","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:27:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:35:31","updated":"2026-02-08 20:27:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/33717","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=33717"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/33717\/revisions"}],"predecessor-version":[{"id":157777,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/33717\/revisions\/157777"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=33717"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=33717"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=33717"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}