Hallo,
beigefügte meine configs:
named.conf
Code: Alles auswählen
// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
named.conf.local
Code: Alles auswählen
//
// Do any local configuration here
//
// Consider adding the 1918 zone here, if they are not used in your
// organisatization
// include "/etc/bind/zones.rfc1918";
logging {
category default { default_syslog; default_debug; };
category unmatched { null; };
};
## LDAP Backend mit DLZ-Schema
dlz "xyz.de" {
database "ldap 1
v3 simple {cn=admin,ou=dns,dc=xyz,dc=de} {secret} 127.0.0.1
ldap:///dlzZoneName=$zone$,ou=dns,dc=xyz,dc=de???objectclass=dlzZone
ldap:///dlzHostName=$record$,dlzZoneName=$zone$,ou=dns,dc=xyz,dc=de?dlzTTL,dlzType,dlzPreference,dlzData,dlzIPAddr,dlzPrimaryNS,dlzAdminEmail,dlzSerial,dlz$
};
named.conf.options
Code: Alles auswählen
options {
directory "/var/cache/bind";
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
//listen-on { 192.168.178.9; 192.168.200.1; };
//recursion yes;
forwarders { 217.0.43.33; 217.0.43.49; };
//forward only;
//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys. See https://www.isc.org/bind-keys
//========================================================================
//dnssec-validation auto;
empty-zones-enable no; # Permit Empty Zones to RFC1918
auth-nxdomain no; # conform to RFC1035
//listen-on-v6 { any; };
};
Auszug über tcpdump, Auflösung von avm.de am Server
Code: Alles auswählen
11:51:05.919839 IP dsme01.xyz.de.41882 > k-nxr-a01.isp.t-ipnet.de.domain: 58049+ [1au] A? avm.de. (35)
11:51:05.919933 IP dsme01.xyz.de.28340 > k-nxr-a01.isp.t-ipnet.de.domain: 30713+ [1au] NS? . (28)
11:51:05.949449 IP k-nxr-a01.isp.t-ipnet.de.domain > dsme01.xyz.de.41882: 58049 1/0/0 A 212.42.244.80 (40)
Auszug über tcpdump, Auflösung von avm.de am Client über VPN
Code: Alles auswählen
11:53:57.077428 IP 192.168.200.97.4674 > dstme01.xyz.de.domain: 7471+ A? avm.de. (24)
11:53:57.078219 IP dstme01.xyz.de.domain > 192.168.200.97.4674: 7471 Refused- 0/0/0 (24)
Ich kann am Client über VPN einfach keine Internetadressen auflösen.
Lieben Gruß von Stefan Harbich
