Всех приветствую Есть два ДНС сервера master и slave На slave рекурсивные запросы обрабатываются очень долго, немогу понять почему. Предположительно некоректно работаю корневые зоны. мой конфиг
master
named.conf
cat named.conf
// Red Hat BIND Configuration Tool
//
// Default initial "Caching Only" name server configuration
//
options {
listen-on port 53 { 127.0.0.1; 10.1.1.252; xxx.xxx.xxx; };
listen-on-v6 port 53 { ::1; };
directory "/var/named/chroot/var/named";
dump-file "/var/named/chroot/var/named/data/cache_dump.db";
statistics-file "/var/named/chroot/var/named/data/named_stats.txt";
memstatistics-file "/var/named/chroot/var/named/data/named_mem_stats.txt";
version "DNS Server";
allow-query { any; };
allow-transfer { 10.1.1.16; yyy.yyy.yyy; };
notify yes;
allow-recursion { 127.0.0.1; 10.1.1.0/24; };
recursion yes;
notify-source * port 53;
transfer-source * port 53;
};
#
view internal {
#зоны ресолвятся для клиентов сетей 10.1.1.0/24 и локалхоста
match-clients { 127.0.0.1; 10.1.1.0/24; };
zone
......
view external {
#Для всех остальных сетей и IP которые явно не указаны в предыдущих view
match-clients { any; };
zone
.......
zone "." IN {
type hint;
file "named.root";
};
zone "localdomain." IN {
type master;
file "localdomain.zone";
allow-update { none; };
};
zone "localhost." IN {
type master;
file "localhost.zone";
allow-update { none; };
};
zone "0.0.127.in-addr.arpa." IN {
type master;
file "named.local";
allow-update { none; };
};
zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." IN {
type master;
file "named.ip6.local";
allow-update { none; };
};
zone "255.in-addr.arpa." IN {
type master;
file "named.broadcast";
allow-update { none; };
};
zone "0.in-addr.arpa." IN {
type master;
file "named.zero";
allow-update { none; };
};
include "/etc/rndc.key";
slave
named.conf
cat named.conf
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
listen-on port 53 { 127.0.0.1; 10.1.1.16; 192.168.0.99; };
listen-on-v6 port 53 { none; };
directory "/var/named/chroot/var/named";
dump-file "/var/named/chroot/var/named/data/cache_dump.db";
statistics-file "/var/named/chroot/var/named/data/named_stats.txt";
memstatistics-file "/var/named/chroot/var/named/data/named_mem_stats.txt";
version "DNS Server";
allow-query { any; };
allow-notify { 10.1.1.252; xxx.xxx.xxx; };
allow-recursion { 127.0.0.1; 10.1.1.0/24; };
recursion yes;
/*
* If there is a firewall between you and nameservers you want
* to talk to, you might need to uncomment the query-source
* directive below. Previous versions of BIND always asked
* questions using port 53, but BIND 8.1 uses an unprivileged
* port by default.
*/
};
logging {
channel systemlog {
file "/var/named/chroot/var/log/named.log";
severity debug;
print-time yes;
};
channel audit_log {
file "/var/named/chroot/var/log/security.log";
severity debug;
print-time yes;
};
channel xfer_log {
file "/var/named/chroot/var/log/xfer.log";
severity debug;
print-time yes;
};
category default { systemlog; };
category security { audit_log; systemlog; };
category config { systemlog; };
category xfer-in { xfer_log; };
category xfer-out { xfer_log; };
category notify { audit_log; };
category update { audit_log; };
category queries { audit_log; };
category lame-servers { audit_log; };
};
view internal {
#зоны ресолвятся для клиентов сетей 10.1.1.0/24 и локалхоста
match-clients { 127.0.0.1; 10.1.1.0/24; };
// required zone for recursive queries
zone
........
view external {
#Для всех остальных сетей и IP которые явно не указаны в предыдущих view
match-clients { any; };
// required zone for recursive queries
zone
......
zone "." IN {
type hint;
file "root.servers";
};
zone "localdomain." IN {
type master;
file "localdomain.zone";
allow-update { none; };
};
zone "localhost." IN {
type master;
file "localhost.zone";
allow-update { none; };
};
include "/etc/rndc.key";
dig @127.0.0.1 itc.ua
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.4 <<>> @127.0.0.1 itc.ua
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31141
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1
;; QUESTION SECTION:
;itc.ua. IN A
;; ANSWER SECTION:
itc.ua. 7200 IN A 77.222.150.27
;; AUTHORITY SECTION:
itc.ua. 72070 IN NS ns.elvisti.kiev.ua.
itc.ua. 72070 IN NS ns2.elvisti.kiev.ua.
;; ADDITIONAL SECTION:
ns.elvisti.kiev.ua. 7200 IN A 195.64.225.197
;; Query time: 3434 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Oct 8 11:16:31 2012
;; MSG SIZE rcvd: 104
dig @127.0.0.1 itc.ua
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.4 <<>> @127.0.0.1 itc.ua
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34567
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;itc.ua. IN A
;; ANSWER SECTION:
itc.ua. 415 IN A 77.222.150.27
;; AUTHORITY SECTION:
itc.ua. 65287 IN NS ns.elvisti.kiev.ua.
itc.ua. 65287 IN NS ns2.elvisti.kiev.ua.
;; ADDITIONAL SECTION:
ns.elvisti.kiev.ua. 5106 IN A 195.64.225.197
ns2.elvisti.kiev.ua. 5106 IN A 195.64.225.199
;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Oct 8 11:16:50 2012
;; MSG SIZE rcvd: 120
