{"id":33717,"date":"2019-10-31T21:54:20","date_gmt":"2019-10-31T18:54:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet\/"},"modified":"2019-10-31T21:54:20","modified_gmt":"2019-10-31T18:54:20","slug":"delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","title":{"rendered":"Delegation av omv\u00e4nd zon f\u00f6r subnett mindre \u00e4n \/24 i BIND. Hur det fungerar","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En g\u00e5ng stod jag inf\u00f6r uppgiften att ge en av mina kunder r\u00e4tt att redigera PTR-poster f\u00f6r den tilldelade subnetten \/28. Jag har ingen automatisering f\u00f6r att redigera BIND-inst\u00e4llningar externt. D\u00e4rf\u00f6r beslutade jag mig f\u00f6r att g\u00e5 en annan v\u00e4g \u2013 att delegera en del av PTR-zonen av subnettet \/24 till kunden.<\/p>\n

Det verkar som om det skulle kunna vara enklare? Vi specificerar helt enkelt subnettet p\u00e5 r\u00e4tt s\u00e4tt och pekar mot r\u00e4tt NS, precis som man g\u00f6r med en underdom\u00e4n. Men nej. Det \u00e4r inte s\u00e5 enkelt (\u00e4ven om det i praktiken \u00e4r v\u00e4ldigt grundl\u00e4ggande, men intuitionen hj\u00e4lper inte ), och d\u00e4rf\u00f6r skriver jag den h\u00e4r artikeln.<\/p>\n

Den som vill ta reda p\u00e5 detta sj\u00e4lv kan l\u00e4sa. RFC<\/a><\/noindex>
\nDe som vill ha en f\u00e4rdig l\u00f6sning \u00e4r v\u00e4lkomna under artikeln.
\n<\/a><\/noindex>
\nF\u00f6r att inte h\u00e5lla dem som \u00e4lskar att kopiera och klistra in, kommer jag f\u00f6rst att l\u00e4gga upp den praktiska delen, f\u00f6ljt av den teoretiska.<\/p>\n

1. Praktik. Delegerar zonen \/28.<\/b><\/p>\n

Anta att vi har en subnet. 7.8.9.0\/24<\/b>. Vi m\u00e5ste delegera subnet. 7.8.9.240\/28<\/b> till dns-klienten. 7.8.7.8<\/b> (ns1.client.domain.<\/b>).<\/p>\n

P\u00e5 leverant\u00f6rens DNS beh\u00f6ver vi hitta filen som beskriver den omv\u00e4nda zonen f\u00f6r denna subnet. L\u00e5t oss kalla den. 9.8.7.in-addr.arpa.<\/b>.
\nKommentera posterna fr\u00e5n 240 till 255, om det finns n\u00e5gra. Och i slutet av filen skriver vi f\u00f6ljande:<\/p>\n

255-240  IN  NS      7.8.7.8\n$GENERATE 240-255 $ CNAME $.255-240<\/code><\/pre>\n
\nkom ih\u00e5g att \u00f6ka zonens serial och k\u00f6r <\/p>\n
rndc reload.<\/code><\/pre>\n
\nDetta avslutar leverant\u00f6rsdelen. L\u00e5t oss g\u00e5 vidare till klientens DNS.<\/p>\n
F\u00f6rst skapar vi filen. \/etc\/bind\/master\/255-240.9.8.7.in-addr.arpa<\/b> med f\u00f6ljande inneh\u00e5ll:<\/p>\n
$ORIGIN 255-240.9.8.7.in-addr.arpa.\n$TTL 1W\n@                       1D IN SOA       ns1.client.domain. root.client.domain. (\n                        2008152607      ; serial\n                        3H              ; refresh\n                        15M             ; retry\n                        1W              ; expiry\n                        1D )            ; minimum\n@                       IN NS        ns1.client.domain.\n@                       IN NS        ns2.client.domain.\n241                     IN PTR          test.client.domain.\n242                     IN PTR          test2.client.domain.\n245                     IN PTR          test5.client.domain.\n<\/code><\/pre>\n
\nOch i named.conf<\/b> l\u00e4gger vi till beskrivningen av v\u00e5r nya fil:<\/p>\n
zone \"255-240.9.8.7.in-addr.arpa.\" IN {\n        type master;\n        file \"master\/255-240.9.8.7.in-addr.arpa\";\n};<\/code><\/pre>\n
\nB startar vi om bind-processen.<\/p>\n
\/etc\/init.d\/named restart<\/code><\/pre>\n
\nDet \u00e4r klart. Nu kan vi b\u00f6rja kontrollera.<\/p>\n
#>  host 7.8.9.245 \n245.9.8.7.in-addr.arpa is an alias for 245.255-240.9.8.7.in-addr.arpa.\n245.255-240.9.8.7.in-addr.arpa domain name pointer test5.client.domain.<\/code><\/pre>\n
\nObservera att det inte bara returneras PTR-poster utan \u00e4ven CNAME. S\u00e5 ska det vara. Om du \u00e4r nyfiken p\u00e5 varf\u00f6r, s\u00e5 v\u00e4lkommen till n\u00e4sta kapitel.<\/p>\n
2. Teori. Hur fungerar det.<\/b><\/p>\n
Det \u00e4r sv\u00e5rt att konfigurera och debugga en svart l\u00e5da. Mycket enklare om man f\u00f6rst\u00e5r vad som h\u00e4nder inuti.<\/p>\n
N\u00e4r vi delegerar en underdom\u00e4n i dom\u00e4nen domain<\/b>, s\u00e5 skriver vi n\u00e5got liknande detta:<\/p>\n
client.domain.\tNS\tns1.client.domain.\nns1.client.domain.\tA\t7.8.7.8<\/code><\/pre>\n
\nVi s\u00e4ger till alla som fr\u00e5gar att vi inte ansvarar f\u00f6r denna zon och ber\u00e4ttar vem som g\u00f6r det. Och alla f\u00f6rfr\u00e5gningar om client.domain<\/b> redirigeras till 7.8.7.8. Vid kontroll ser vi f\u00f6ljande bild (l\u00e5t oss utel\u00e4mna vad som finns hos klienten. Det spelar ingen roll):<\/p>\n
# host test.client.domain\ntest.client.domain has address 7.8.9.241<\/code><\/pre>\n
\nDet vill s\u00e4ga, vi fick veta att det finns en s\u00e5dan A-post och dess ip 7.8.9.241. Ingen \u00f6verfl\u00f6dig information.<\/p>\n
Hur kan man g\u00f6ra samma sak med ett subnet?<\/b><\/p>\n
Eftersom v\u00e5r DNS-server \u00e4r registrerad i RIPE, s\u00e5 vid en PTR-f\u00f6rfr\u00e5gan om en ip-adress fr\u00e5n v\u00e5rt n\u00e4tverk kommer den f\u00f6rsta f\u00f6rfr\u00e5gan att vara till oss. Logiken \u00e4r densamma som med dom\u00e4ner. Men hur skriver man in subnet i zonfilen?<\/p>\n
Vi f\u00f6rs\u00f6ker skriva in det s\u00e5 h\u00e4r:<\/p>\n
255-240  IN  NS      7.8.7.8<\/code><\/pre>\n
\nOch\u2026 inget mirakel intr\u00e4ffade. Vi f\u00e5r ingen omdirigering av f\u00f6rfr\u00e5gan. Allt handlar om att bind \u00f6verhuvudtaget inte \u00e4r medveten om att dessa poster i bakzonen \u00e4r IP-adresser och f\u00f6rst\u00e5r \u00e4n mindre intervallposten. F\u00f6r honom \u00e4r det bara en viss symbolisk subdom\u00e4n. Det vill s\u00e4ga f\u00f6r bind kommer det inte att g\u00f6ra n\u00e5gon skillnad mellan «255-240<\/b>\" och \"oursuperclient<\/b>«. Och f\u00f6r att f\u00f6rfr\u00e5gan ska g\u00e5 dit den ska, m\u00e5ste adressen i f\u00f6rfr\u00e5gan se ut s\u00e5 h\u00e4r: 241.255-240.9.8.7.in-addr.arpa<\/b>. Eller s\u00e5 h\u00e4r, om vi anv\u00e4nder en symbolisk subdom\u00e4n: 241.oursuperclient.9.8.7.in-addr.arpa<\/b>. Detta skiljer sig fr\u00e5n det vanliga: 241.9.8.7.in-addr.arpa<\/b>.<\/p>\n
Att g\u00f6ra en s\u00e5dan f\u00f6rfr\u00e5gan f\u00f6r hand kommer att vara problematiskt. Och om det ens lyckas, \u00e4r det fortfarande oklart hur detta ska till\u00e4mpas i verkligheten. Eftersom p\u00e5 f\u00f6rfr\u00e5gan 7.8.9.241<\/b> f\u00e5r vi fortfarande svar fr\u00e5n leverant\u00f6rens DNS, inte fr\u00e5n klientens.<\/p>\n
Och h\u00e4r kommer CNAME<\/b>.<\/p>\n
Inom leverant\u00f6rens sida m\u00e5ste man g\u00f6ra ett alias f\u00f6r alla ip-adresser i subnetet i ett format som dirigerar f\u00f6rfr\u00e5gningar till klientens DNS.<\/p>\n
255-240  IN  NS      ns1.client.domain.\n241     IN  CNAME   241.255-240\n242     IN  CNAME   242.255-240\noch s\u00e5 vidare.\n<\/code><\/pre>\n
\nDetta \u00e4r f\u00f6r flitiga =). <\/p>\n
Och f\u00f6r lata passar konstruktionen nedan b\u00e4ttre:<\/p>\n
255-240  IN  NS      ns1.client.domain.\n$GENERATE 240-255 $ CNAME $.255-240<\/code><\/pre>\n
\nNu kommer en f\u00f6rfr\u00e5gan om information fr\u00e5n 7.8.9.241<\/b> fr\u00e5n 241.9.8.7.in-addr.arpa<\/b> till leverant\u00f6rens dns-server att omvandlas till 241.255-240.9.8.7.in-addr.arpa<\/b> och skickas till dns-klienten. <\/p>\n
Fr\u00e5n klientens sida beh\u00f6ver vi hantera s\u00e5dana f\u00f6rfr\u00e5gningar. D\u00e4rf\u00f6r skapar vi en zon 255-240.9.8.7.in-addr.arpa<\/b>. I den kan vi i princip placera omv\u00e4nda poster f\u00f6r alla ip i hela subnetet \/24, men de som vi kommer att fr\u00e5ga om \u00e4r endast de som leverant\u00f6ren vidarebefordrar till oss, s\u00e5 vi kan inte leka f\u00f6r mycket =).
\nF\u00f6r illustration kommer jag \u00e5terigen att ge ett exempel p\u00e5 inneh\u00e5llet i zonfilen f\u00f6r omv\u00e4nd zon fr\u00e5n klientens sida:<\/p>\n
$ORIGIN 255-240.9.8.7.in-addr.arpa.\n$TTL 1W\n@                       1D IN SOA       ns1.client.domain. root.client.domain. (\n                        2008152607      ; serial\n                        3H              ; refresh\n                        15M             ; retry\n                        1W              ; expiry\n                        1D )            ; minimum\n@                       IN NS        ns1.client.domain.\n@                       IN NS        ns2.client.domain.\n241                     IN PTR          test.client.domain.\n242                     IN PTR          test2.client.domain.\n245                     IN PTR          test5.client.domain.\n<\/code><\/pre>\n
\nDet \u00e4r just f\u00f6r att vi fr\u00e5n leverant\u00f6rens sida anv\u00e4nder CNAME, som vi ocks\u00e5 f\u00e5r tv\u00e5 svarsalternativ p\u00e5 beg\u00e4ran av data via IP-adressen<\/a> , inte ett.<\/p>\n
#>  host 7.8.9.245 \n245.9.8.7.in-addr.arpa is an alias for 245.255-240.9.8.7.in-addr.arpa.\n245.255-240.9.8.7.in-addr.arpa domain name pointer test5.client.domain.<\/code><\/pre>\n
\nOch gl\u00f6m inte att konfigurera ACL korrekt. Det \u00e4r meningsl\u00f6st att ta PTR-zonen f\u00f6r sig sj\u00e4lv och inte svara n\u00e5gra externa =).<\/b><\/i>
\n
K\u00e4lla: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0441\u0442\u0430\u043b\u0430 \u043e\u0434\u043d\u0430\u0436\u0434\u044b \u043f\u0435\u0440\u0435\u0434\u043e \u043c\u043d\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0430, \u043e\u0442\u0434\u0430\u0442\u044c \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0430\u0432\u043e \u043d\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 PTR-\u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043e\u0442\u0434\u0430\u043d\u043d\u043e\u0439 \u0435\u043c\u0443 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/28. \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a BIND \u0438\u0437\u0432\u043d\u0435 \u0443 \u043c\u0435\u043d\u044f \u043d\u0435\u0442. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0440\u0435\u0448\u0438\u043b \u043f\u043e\u0439\u0442\u0438 \u0434\u0440\u0443\u0433\u0438\u043c \u043f\u0443\u0442\u0435\u043c \u2014 \u0434\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043b\u0438\u0435\u043d\u0442\u0443 \u043a\u0443\u0441\u043e\u043a PTR-\u0437\u043e\u043d\u044b \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/24. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b \u2014 \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0449\u0435? \u041f\u0440\u043e\u0441\u0442\u043e \u043d\u0443\u0436\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043f\u0440\u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c \u043f\u043e\u0434\u0441\u0435\u0442\u044c \u0438 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c \u043d\u0430 \u043d\u0443\u0436\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33717","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Delegation av omv\u00e4nd zon f\u00f6r subnet mindre \u00e4n \/24 i BIND. Hur det fungerar | ProHoster","description":"En g\u00e5ng stod jag inf\u00f6r uppgiften att ge en av mina kunder r\u00e4tt att redigera PTR-poster f\u00f6r det tilldelade subnettet \/28. Jag har ingen automatisering f\u00f6r att redigera BIND-inst\u00e4llningar utifr\u00e5n.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0437\u043e\u043d\u044b \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u043c\u0435\u043d\u0435\u0435 \/24 \u0432 BIND. \u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 | ProHoster","og:description":"\u0412\u0441\u0442\u0430\u043b\u0430 \u043e\u0434\u043d\u0430\u0436\u0434\u044b \u043f\u0435\u0440\u0435\u0434\u043e \u043c\u043d\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0430, \u043e\u0442\u0434\u0430\u0442\u044c \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0430\u0432\u043e \u043d\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 PTR-\u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043e\u0442\u0434\u0430\u043d\u043d\u043e\u0439 \u0435\u043c\u0443 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \/28. \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a BIND \u0438\u0437\u0432\u043d\u0435 \u0443 \u043c\u0435\u043d\u044f \u043d\u0435\u0442.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/delegirovanie-obratnoj-zony-podseti-menee-24-v-bind-kak-eto-rabotaet","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:20+00:00","article:modified_time":"2019-10-31T18:54:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33717","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:27:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:35:31","updated":"2026-02-08 20:27:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/33717","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=33717"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/33717\/revisions"}],"predecessor-version":[{"id":157777,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/33717\/revisions\/157777"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=33717"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=33717"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=33717"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}