Raspberry Pi Secondary DNS Server: Difference between revisions
Jump to navigation
Jump to search
(→Zones) |
No edit summary |
||
| (16 intermediate revisions by the same user not shown) | |||
| Line 9: | Line 9: | ||
<source lang="bash"> | <source lang="bash"> | ||
GTW : 10.19.83.1 (Gateway/Router) | GTW : 10.19.83.1 (Gateway/Router) | ||
DMZ : 10.19.83. | DMZ : 10.19.83.100 (bgd.chorke.org & Name server) | ||
LAN : 10.19.83.0/24 (Private network & range 0~255) | LAN : 10.19.83.0/24 (Private network & range 0~255) | ||
</source> | </source> | ||
| Line 31: | Line 31: | ||
</source> | </source> | ||
==Options== | ==Primary Options== | ||
<code>nano /etc/bind/named.conf.options</code> | <code>nano /etc/bind/named.conf.options</code> | ||
<source lang="ini"> | <source lang="ini" highlight="3,8,19,20,29,30"> | ||
acl internals { | acl internals { | ||
127.0.0.0/24; # 0-255 | |||
10.19.83.0/24; # 0-255 | |||
}; | }; | ||
acl externals { | acl externals { | ||
10.19.83.0/29; # 0-7 | |||
!10.19.83.0/24; # 0-255 | |||
}; | }; | ||
options { | options { | ||
directory "/var/cache/bind"; | |||
auth-nxdomain no; | |||
forwarders { | // If there is a firewall between you and nameservers you want | ||
// to talk to, you may need to fix the firewall to allow multiple | |||
// ports to talk. See http://www.kb.cert.org/vuls/id/800113 | |||
listen-on port 53 { | |||
127.0.0.1; | |||
10.19.83.100; | |||
}; | |||
// If your ISP provided one or more IP addresses for stable | |||
// nameservers, you probably want to use them as forwarders. | |||
// Uncomment the following block, and insert the addresses replacing | |||
// the all-0's placeholder. | |||
}; | forwarders { | ||
8.8.8.8; # Google DNS | |||
8.8.4.4; # Google DNS | |||
}; | |||
//======================================================================== | |||
// If BIND logs error messages about the root key being expired, | |||
// you will need to update your keys. See https://www.isc.org/bind-keys | |||
//======================================================================== | |||
dnssec-validation auto; | |||
recursion yes; | |||
listen-on-v6 { none; }; | |||
allow-transfer { none; }; | |||
allow-query { internals; }; | |||
allow-recursion { internals; }; | |||
}; | |||
</source> | </source> | ||
==Zones== | ==Primary Zones== | ||
<code>nano /etc/bind/named.conf.local</code> | <code>nano /etc/bind/named.conf.local</code> | ||
<source lang="ini"> | <source lang="ini" highlight="6-9,16-19"> | ||
include "/etc/bind/rndc.key"; | include "/etc/bind/rndc.key"; | ||
zone "bgd.chorke.org" { | zone "bgd.chorke.org" { | ||
| Line 72: | Line 88: | ||
file "/etc/bind/zones/db.bgd.chorke.org"; # zone file path | file "/etc/bind/zones/db.bgd.chorke.org"; # zone file path | ||
allow-update { key rndc-key; }; | allow-update { key rndc-key; }; | ||
allow-transfer { | |||
10.19.83.101; | |||
10.19.83.102; | |||
}; | |||
}; | }; | ||
| Line 78: | Line 98: | ||
file "/etc/bind/zones/db.83.19.10"; # 10.19.83.0/24 subnet | file "/etc/bind/zones/db.83.19.10"; # 10.19.83.0/24 subnet | ||
allow-update { key rndc-key; }; | allow-update { key rndc-key; }; | ||
allow-transfer { | |||
10.19.83.101; | |||
10.19.83.102; | |||
}; | |||
}; | }; | ||
| Line 92: | Line 116: | ||
<source lang="ini"> | <source lang="ini"> | ||
; | ; | ||
; BIND forward data file | ; BIND forward data file | ||
| Line 99: | Line 122: | ||
$ORIGIN bgd.chorke.org. | $ORIGIN bgd.chorke.org. | ||
@ IN SOA | @ IN SOA dns0.bgd.chorke.org. root.bgd.chorke.org. ( | ||
202012050 ; Serial YYYYmmddI | |||
3600 ; Refresh 01H | 3600 ; Refresh 01H | ||
600 ; Retry 10M | 600 ; Retry 10M | ||
86400 ; Expire 01D | 86400 ; Expire 01D | ||
600 ) ; Negative Cache TTL 10M | 600 ) ; Negative Cache TTL 10M | ||
; NS Records | ; NS Records Name Servers | ||
@ IN NS | @ IN NS dns0.bgd.chorke.org. | ||
@ IN NS | @ IN NS dns1.bgd.chorke.org. | ||
@ IN NS | @ IN NS dns2.bgd.chorke.org. | ||
@ IN A 10.19.83. | @ IN A 10.19.83.100 | ||
; A Records Name Servers | ; A Records Name Servers | ||
dns0 A 10.19.83.100 | |||
dns1 A 10.19.83.101 | |||
dns2 A 10.19.83.102 | |||
; A Records 10.19.83.0/24 | ; A Records 10.19.83.0/24 | ||
apn0 A 10.19.83.2 | |||
db00 A 10.19.83.105 | |||
db01 A 10.19.83.208 | |||
db02 A 10.19.83.109 | |||
dmz0 A 10.19.83.100 | |||
ftp0 A 10.19.83.204 | |||
git0 A 10.19.83.206 | |||
gtw0 A 10.19.83.1 | |||
iis0 A 10.19.83.207 | |||
mac0 A 10.19.83.110 | |||
mcu0 A 10.19.83.99 | |||
mob0 A 10.19.83.4 | |||
mob1 A 10.19.83.5 | |||
mob2 A 10.19.83.6 | |||
nas0 A 10.19.83.204 | |||
ns00 A 10.19.83.100 | |||
ns01 A 10.19.83.101 | |||
ns02 A 10.19.83.102 | |||
ns03 A 10.19.83.203 | |||
ns04 A 10.19.83.204 | |||
ns05 A 10.19.83.105 | |||
ns06 A 10.19.83.206 | |||
ns07 A 10.19.83.207 | |||
ns08 A 10.19.83.208 | |||
ns09 A 10.19.83.109 | |||
ns10 A 10.19.83.110 | |||
pc00 A 10.19.83.207 | |||
pc01 A 10.19.83.208 | |||
pc02 A 10.19.83.109 | |||
pc03 A 10.19.83.110 | |||
pi00 A 10.19.83.100 | |||
pi01 A 10.19.83.101 | |||
pi02 A 10.19.83.102 | |||
pi03 A 10.19.83.203 | |||
pi04 A 10.19.83.204 | |||
pi05 A 10.19.83.105 | |||
pi06 A 10.19.83.206 | |||
tab0 A 10.19.83.7 | |||
tv00 A 10.19.83.3 | |||
vpn0 A 10.19.83.203 | |||
www0 A 10.19.83.100 | |||
; CNAME | ; CNAME | ||
www CNAME www0 | |||
</source> | </source> | ||
| Line 142: | Line 195: | ||
; BIND reverse data file | ; BIND reverse data file | ||
; | ; | ||
$TTL | |||
$TTL 600 ; 10M | |||
$ORIGIN 83.19.10.in-addr.arpa. | $ORIGIN 83.19.10.in-addr.arpa. | ||
@ IN SOA | @ IN SOA dns0.bgd.chorke.org. root.bgd.chorke.org. ( | ||
202012050 ; Serial YYYYmmddI | |||
3600 ; Refresh 01H | 3600 ; Refresh 01H | ||
600 ; Retry 10M | 600 ; Retry 10M | ||
| Line 152: | Line 206: | ||
600 ) ; Negative Cache TTL 10M | 600 ) ; Negative Cache TTL 10M | ||
; NS Records | ; NS Records | ||
@ IN NS | @ IN NS dns0.bgd.chorke.org. | ||
@ IN NS | @ IN NS dns1.bgd.chorke.org. | ||
@ IN NS | @ IN NS dns2.bgd.chorke.org. | ||
; PTR Records | ; PTR Records | ||
1 IN PTR | 1 IN PTR gtw0.bgd.chorke.org. | ||
2 IN PTR | 2 IN PTR apn0.bgd.chorke.org. | ||
3 IN PTR | 3 IN PTR tv00.bgd.chorke.org. | ||
4 IN PTR mob0.bgd.chorke.org. | |||
5 IN PTR mob1.bgd.chorke.org. | |||
6 IN PTR mob2.bgd.chorke.org. | |||
7 IN PTR tab0.bgd.chorke.org. | |||
99 IN PTR mcu0.bgd.chorke.org. | |||
100 IN PTR dmz0.bgd.chorke.org. | |||
100 IN PTR dns0.bgd.chorke.org. | |||
100 IN PTR ns00.bgd.chorke.org. | |||
100 IN PTR pi00.bgd.chorke.org. | |||
100 IN PTR www.bgd.chorke.org. | |||
100 IN PTR www0.bgd.chorke.org. | |||
101 IN PTR dns1.bgd.chorke.org. | |||
101 IN PTR ns01.bgd.chorke.org. | |||
101 IN PTR pi01.bgd.chorke.org. | |||
102 IN PTR dns2.bgd.chorke.org. | |||
102 IN PTR ns02.bgd.chorke.org. | |||
102 IN PTR pi02.bgd.chorke.org. | |||
105 IN PTR ns05.bgd.chorke.org. | |||
105 IN PTR pi05.bgd.chorke.org. | |||
105 IN PTR rdb0.bgd.chorke.org. | |||
109 IN PTR db02.bgd.chorke.org. | |||
109 IN PTR ns09.bgd.chorke.org. | |||
109 IN PTR pc02.bgd.chorke.org. | |||
110 IN PTR mac0.bgd.chorke.org. | |||
110 IN PTR ns10.bgd.chorke.org. | |||
110 IN PTR pc03.bgd.chorke.org. | |||
203 IN PTR ns03.bgd.chorke.org. | |||
203 IN PTR pi03.bgd.chorke.org. | |||
203 IN PTR vpn0.bgd.chorke.org. | |||
204 IN PTR ftp0.bgd.chorke.org. | |||
204 IN PTR nas0.bgd.chorke.org. | |||
204 IN PTR ns04.bgd.chorke.org. | |||
204 IN PTR pi04.bgd.chorke.org. | |||
206 IN PTR git0.bgd.chorke.org. | |||
206 IN PTR ns06.bgd.chorke.org. | |||
206 IN PTR pi06.bgd.chorke.org. | |||
207 IN PTR iis0.bgd.chorke.org. | |||
207 IN PTR ns07.bgd.chorke.org. | |||
207 IN PTR pc00.bgd.chorke.org. | |||
208 IN PTR ns08.bgd.chorke.org. | |||
208 IN PTR pc01.bgd.chorke.org. | |||
208 IN PTR rdb1.bgd.chorke.org. | |||
</source> | |||
==Secondary Options== | |||
<code>nano /etc/bind/named.conf.options</code> | |||
<source lang="ini" highlight="20"> | |||
acl internals { | |||
127.0.0.0/24; # 0-255 | |||
10.19.83.0/24; # 0-255 | |||
}; | |||
acl externals { | |||
10.19.83.0/29; # 0-7 | |||
!10.19.83.0/24; # 0-255 | |||
}; | |||
options { | |||
directory "/var/cache/bind"; | |||
auth-nxdomain no; | |||
// If there is a firewall between you and nameservers you want | |||
// to talk to, you may need to fix the firewall to allow multiple | |||
// ports to talk. See http://www.kb.cert.org/vuls/id/800113 | |||
listen-on port 53 { | |||
127.0.0.1; | |||
10.19.83.101; | |||
}; | |||
// If your ISP provided one or more IP addresses for stable | |||
// nameservers, you probably want to use them as forwarders. | |||
// Uncomment the following block, and insert the addresses replacing | |||
// the all-0's placeholder. | |||
forwarders { | |||
8.8.8.8; # Google DNS | |||
8.8.4.4; # Google DNS | |||
}; | |||
//======================================================================== | |||
// If BIND logs error messages about the root key being expired, | |||
// you will need to update your keys. See https://www.isc.org/bind-keys | |||
//======================================================================== | |||
dnssec-validation auto; | |||
recursion yes; | |||
listen-on-v6 { none; }; | |||
allow-transfer { none; }; | |||
allow-query { internals; }; | |||
allow-recursion { internals; }; | |||
}; | |||
</source> | |||
==Secondary Zones== | |||
<code>nano /etc/bind/named.conf.local</code> | |||
<source lang="ini" highlight="3-5,9-11"> | |||
include "/etc/bind/rndc.key"; | |||
zone "bgd.chorke.org" { | |||
type slave; | |||
file "db.bgd.chorke.org"; # zone file path | |||
masters { 10.19.83.100; }; | |||
}; | |||
zone "83.19.10.in-addr.arpa" { | |||
type slave; | |||
file "db.83.19.10"; # 10.19.83.0/24 subnet | |||
masters { 10.19.83.100; }; | |||
}; | |||
// consider adding the 1918 zones here | |||
// include "/etc/bind/zones.rfc1918"; | |||
</source> | </source> | ||
| Line 199: | Line 352: | ||
<source lang="ini"> | <source lang="ini"> | ||
# Chorke Academia, Inc. | # Chorke Academia, Inc. | ||
#static domain_name_servers=10.19.83. | #static domain_name_servers=10.19.83.100 10.19.83.1 | ||
static domain_search=bgd.chorke.org | static domain_search=bgd.chorke.org | ||
#static host_name=pih | #static host_name=pih | ||
</source> | </source> | ||
<source lang="bash"> | <source lang="bash" highlight="5,6"> | ||
sudo systemctl restart dhcpcd | sudo systemctl restart dhcpcd | ||
sudo systemctl daemon-reload | sudo systemctl daemon-reload | ||
sudo apt install resolvconf | |||
sudo apt install openresolv | |||
sudo resolvconf -u | |||
</source> | </source> | ||
| Line 217: | Line 374: | ||
<source lang="bash"> | <source lang="bash"> | ||
scutil --dns | |||
scutil -r hostname | |||
# clear macos dns cache | # clear macos dns cache | ||
sudo dscacheutil -flushcache | |||
sudo killall -HUP mDNSResponder | sudo killall -HUP mDNSResponder | ||
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist | |||
sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist | |||
</source> | </source> | ||
| Line 230: | Line 392: | ||
<source lang="bash"> | <source lang="bash"> | ||
#from local area network | #from local area network | ||
dig @10.19.83. | dig @10.19.83.100 chorke.org | ||
dig @10.19.83. | dig @10.19.83.100 bgd.chorke.org | ||
dig @10.19.83. | dig @10.19.83.100 apn.bgd.chorke.org | ||
dig @10.19.83. | dig @10.19.83.100 gtw.bgd.chorke.org | ||
</source> | </source> | ||
| Line 243: | Line 404: | ||
dig @bgd.chorke.org bgd.chorke.org | dig @bgd.chorke.org bgd.chorke.org | ||
dig @bgd.chorke.org apn.bgd.chorke.org | dig @bgd.chorke.org apn.bgd.chorke.org | ||
dig @bgd.chorke.org gtw.bgd.chorke.org | dig @bgd.chorke.org gtw.bgd.chorke.org | ||
</source> | </source> | ||
| Line 252: | Line 412: | ||
nslookup bgd.chorke.org | nslookup bgd.chorke.org | ||
nslookup apn.bgd.chorke.org | nslookup apn.bgd.chorke.org | ||
nslookup gtw.bgd.chorke.org | nslookup gtw.bgd.chorke.org | ||
</source> | </source> | ||
| Line 267: | Line 426: | ||
* [http://www.zytrax.com/books/dns/ch6/mydomain.html DNS Sample External Domain Zone file] | * [http://www.zytrax.com/books/dns/ch6/mydomain.html DNS Sample External Domain Zone file] | ||
* [http://www.zytrax.com/books/dns/ch7/address_match_list.html BIND Definition of Address List Match] | * [http://www.zytrax.com/books/dns/ch7/address_match_list.html BIND Definition of Address List Match] | ||
* [https://apple.stackexchange.com/questions/26616 DNS not resolving on Mac OS X] | |||
* [http://www.zytrax.com/books/dns/ch6/#stealth Stealth (Split/DMZ) DNS Server] | * [http://www.zytrax.com/books/dns/ch6/#stealth Stealth (Split/DMZ) DNS Server] | ||
* [http://www.zytrax.com/books/dns/ch7/statements.html List of Statements] | * [http://www.zytrax.com/books/dns/ch7/statements.html List of Statements] | ||
Latest revision as of 10:11, 4 December 2020
Domain Information
Domain : chorke.org
Subdomain : bgd.chorke.org (public)
CNAME of dev : cki00.ddns.net (noip.com)
Netowrk Information
GTW : 10.19.83.1 (Gateway/Router)
DMZ : 10.19.83.100 (bgd.chorke.org & Name server)
LAN : 10.19.83.0/24 (Private network & range 0~255)
Install
sudo su
apt update && apt upgrade
apt install bind9 bind9utils bind9-doc dnsutils
#apt purge bind9 bind9utils bind9-doc dnsutils
#sudo apt autoremove
nano /etc/default/bind9
# run resolvconf?
RESOLVCONF=no
# startup options for the server
OPTIONS="-u bind -4"
Primary Options
nano /etc/bind/named.conf.options
acl internals {
127.0.0.0/24; # 0-255
10.19.83.0/24; # 0-255
};
acl externals {
10.19.83.0/29; # 0-7
!10.19.83.0/24; # 0-255
};
options {
directory "/var/cache/bind";
auth-nxdomain no;
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
listen-on port 53 {
127.0.0.1;
10.19.83.100;
};
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
forwarders {
8.8.8.8; # Google DNS
8.8.4.4; # Google DNS
};
//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys. See https://www.isc.org/bind-keys
//========================================================================
dnssec-validation auto;
recursion yes;
listen-on-v6 { none; };
allow-transfer { none; };
allow-query { internals; };
allow-recursion { internals; };
};
Primary Zones
nano /etc/bind/named.conf.local
include "/etc/bind/rndc.key";
zone "bgd.chorke.org" {
type master;
file "/etc/bind/zones/db.bgd.chorke.org"; # zone file path
allow-update { key rndc-key; };
allow-transfer {
10.19.83.101;
10.19.83.102;
};
};
zone "83.19.10.in-addr.arpa" {
type master;
file "/etc/bind/zones/db.83.19.10"; # 10.19.83.0/24 subnet
allow-update { key rndc-key; };
allow-transfer {
10.19.83.101;
10.19.83.102;
};
};
// consider adding the 1918 zones here
// include "/etc/bind/zones.rfc1918";
Forward Zone
mkdir /etc/bind/zones
cp /etc/bind/db.local /etc/bind/zones/db.bgd.chorke.org
nano /etc/bind/zones/db.bgd.chorke.org
;
; BIND forward data file
;
$TTL 600 ; 10M
$ORIGIN bgd.chorke.org.
@ IN SOA dns0.bgd.chorke.org. root.bgd.chorke.org. (
202012050 ; Serial YYYYmmddI
3600 ; Refresh 01H
600 ; Retry 10M
86400 ; Expire 01D
600 ) ; Negative Cache TTL 10M
; NS Records Name Servers
@ IN NS dns0.bgd.chorke.org.
@ IN NS dns1.bgd.chorke.org.
@ IN NS dns2.bgd.chorke.org.
@ IN A 10.19.83.100
; A Records Name Servers
dns0 A 10.19.83.100
dns1 A 10.19.83.101
dns2 A 10.19.83.102
; A Records 10.19.83.0/24
apn0 A 10.19.83.2
db00 A 10.19.83.105
db01 A 10.19.83.208
db02 A 10.19.83.109
dmz0 A 10.19.83.100
ftp0 A 10.19.83.204
git0 A 10.19.83.206
gtw0 A 10.19.83.1
iis0 A 10.19.83.207
mac0 A 10.19.83.110
mcu0 A 10.19.83.99
mob0 A 10.19.83.4
mob1 A 10.19.83.5
mob2 A 10.19.83.6
nas0 A 10.19.83.204
ns00 A 10.19.83.100
ns01 A 10.19.83.101
ns02 A 10.19.83.102
ns03 A 10.19.83.203
ns04 A 10.19.83.204
ns05 A 10.19.83.105
ns06 A 10.19.83.206
ns07 A 10.19.83.207
ns08 A 10.19.83.208
ns09 A 10.19.83.109
ns10 A 10.19.83.110
pc00 A 10.19.83.207
pc01 A 10.19.83.208
pc02 A 10.19.83.109
pc03 A 10.19.83.110
pi00 A 10.19.83.100
pi01 A 10.19.83.101
pi02 A 10.19.83.102
pi03 A 10.19.83.203
pi04 A 10.19.83.204
pi05 A 10.19.83.105
pi06 A 10.19.83.206
tab0 A 10.19.83.7
tv00 A 10.19.83.3
vpn0 A 10.19.83.203
www0 A 10.19.83.100
; CNAME
www CNAME www0
Reverse Zone
cp /etc/bind/db.127 /etc/bind/zones/db.83.19.10
nano /etc/bind/zones/db.83.19.10
;
; BIND reverse data file
;
$TTL 600 ; 10M
$ORIGIN 83.19.10.in-addr.arpa.
@ IN SOA dns0.bgd.chorke.org. root.bgd.chorke.org. (
202012050 ; Serial YYYYmmddI
3600 ; Refresh 01H
600 ; Retry 10M
86400 ; Expire 01D
600 ) ; Negative Cache TTL 10M
; NS Records
@ IN NS dns0.bgd.chorke.org.
@ IN NS dns1.bgd.chorke.org.
@ IN NS dns2.bgd.chorke.org.
; PTR Records
1 IN PTR gtw0.bgd.chorke.org.
2 IN PTR apn0.bgd.chorke.org.
3 IN PTR tv00.bgd.chorke.org.
4 IN PTR mob0.bgd.chorke.org.
5 IN PTR mob1.bgd.chorke.org.
6 IN PTR mob2.bgd.chorke.org.
7 IN PTR tab0.bgd.chorke.org.
99 IN PTR mcu0.bgd.chorke.org.
100 IN PTR dmz0.bgd.chorke.org.
100 IN PTR dns0.bgd.chorke.org.
100 IN PTR ns00.bgd.chorke.org.
100 IN PTR pi00.bgd.chorke.org.
100 IN PTR www.bgd.chorke.org.
100 IN PTR www0.bgd.chorke.org.
101 IN PTR dns1.bgd.chorke.org.
101 IN PTR ns01.bgd.chorke.org.
101 IN PTR pi01.bgd.chorke.org.
102 IN PTR dns2.bgd.chorke.org.
102 IN PTR ns02.bgd.chorke.org.
102 IN PTR pi02.bgd.chorke.org.
105 IN PTR ns05.bgd.chorke.org.
105 IN PTR pi05.bgd.chorke.org.
105 IN PTR rdb0.bgd.chorke.org.
109 IN PTR db02.bgd.chorke.org.
109 IN PTR ns09.bgd.chorke.org.
109 IN PTR pc02.bgd.chorke.org.
110 IN PTR mac0.bgd.chorke.org.
110 IN PTR ns10.bgd.chorke.org.
110 IN PTR pc03.bgd.chorke.org.
203 IN PTR ns03.bgd.chorke.org.
203 IN PTR pi03.bgd.chorke.org.
203 IN PTR vpn0.bgd.chorke.org.
204 IN PTR ftp0.bgd.chorke.org.
204 IN PTR nas0.bgd.chorke.org.
204 IN PTR ns04.bgd.chorke.org.
204 IN PTR pi04.bgd.chorke.org.
206 IN PTR git0.bgd.chorke.org.
206 IN PTR ns06.bgd.chorke.org.
206 IN PTR pi06.bgd.chorke.org.
207 IN PTR iis0.bgd.chorke.org.
207 IN PTR ns07.bgd.chorke.org.
207 IN PTR pc00.bgd.chorke.org.
208 IN PTR ns08.bgd.chorke.org.
208 IN PTR pc01.bgd.chorke.org.
208 IN PTR rdb1.bgd.chorke.org.
Secondary Options
nano /etc/bind/named.conf.options
acl internals {
127.0.0.0/24; # 0-255
10.19.83.0/24; # 0-255
};
acl externals {
10.19.83.0/29; # 0-7
!10.19.83.0/24; # 0-255
};
options {
directory "/var/cache/bind";
auth-nxdomain no;
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
listen-on port 53 {
127.0.0.1;
10.19.83.101;
};
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
forwarders {
8.8.8.8; # Google DNS
8.8.4.4; # Google DNS
};
//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys. See https://www.isc.org/bind-keys
//========================================================================
dnssec-validation auto;
recursion yes;
listen-on-v6 { none; };
allow-transfer { none; };
allow-query { internals; };
allow-recursion { internals; };
};
Secondary Zones
nano /etc/bind/named.conf.local
include "/etc/bind/rndc.key";
zone "bgd.chorke.org" {
type slave;
file "db.bgd.chorke.org"; # zone file path
masters { 10.19.83.100; };
};
zone "83.19.10.in-addr.arpa" {
type slave;
file "db.83.19.10"; # 10.19.83.0/24 subnet
masters { 10.19.83.100; };
};
// consider adding the 1918 zones here
// include "/etc/bind/zones.rfc1918";
Server
named-checkconf -z
named-checkzone bgd.chorke.org /etc/bind/zones/db.bgd.chorke.org
named-checkzone 83.19.10.in-addr.arpa /etc/bind/zones/db.83.19.10
update-rc.d bind9 enable
/etc/init.d/bind9 restart
service bind9 restart
netstat -tulpn
netstat -tap
reboot
rndc dumpdb -cache
rndc flush
rndc reload
Client
sudo nano /etc/dhcpcd.conf
# Chorke Academia, Inc.
#static domain_name_servers=10.19.83.100 10.19.83.1
static domain_search=bgd.chorke.org
#static host_name=pih
sudo systemctl restart dhcpcd
sudo systemctl daemon-reload
sudo apt install resolvconf
sudo apt install openresolv
sudo resolvconf -u
Debug
@rem clear windows dns cache
ipconfig /flushdns
ipconfig /displaydns
scutil --dns
scutil -r hostname
# clear macos dns cache
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist
sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist
# clear ubuntu dns cache
sudo systemd-resolve --flush-caches
sudo systemd-resolve --statistics
#sudo /etc/init.d/dns-clean start
#from local area network
dig @10.19.83.100 chorke.org
dig @10.19.83.100 bgd.chorke.org
dig @10.19.83.100 apn.bgd.chorke.org
dig @10.19.83.100 gtw.bgd.chorke.org
#from horizon/world wide
dig @bgd.chorke.org chorke.org
dig @bgd.chorke.org -x 10.19.83.1
dig @bgd.chorke.org bgd.chorke.org
dig @bgd.chorke.org apn.bgd.chorke.org
dig @bgd.chorke.org gtw.bgd.chorke.org
#from lan only
nslookup chorke.org
nslookup bgd.chorke.org
nslookup apn.bgd.chorke.org
nslookup gtw.bgd.chorke.org
References
- How To Configure Bind as an Authoritative-Only DNS Server on Ubuntu 14.04
- How To Configure BIND as a Private Network DNS Server on Ubuntu 16.04
- How To Configure BIND as a Private Network DNS Server on Ubuntu 18.04
- Set Up Authoritative DNS Server on Ubuntu 18.04, 16.04 with BIND9
- Raspberry Pi Bind9 DNS/DDNS (Dynamic DNS) Server
- Stealth (DMZ/Hidden Master) Name Server
- Configuring a DNS Server in Raspberry Pi
- Setting up Private DNS Server with BIND9
- DNS Sample External Domain Zone file
- BIND Definition of Address List Match
- DNS not resolving on Mac OS X
- Stealth (Split/DMZ) DNS Server
- List of Statements