Íåñêîëüêî DNS è dnsmasq

**al37919** · 05-03-2010, 08:13

Code:

Jan  1 03:00:11 dnsmasq[164]: read /etc/hosts - 11 addresses
Jan  1 03:00:11 dnsmasq-dhcp[164]: read /etc/ethers - 9 addresses

âî-ïåðâûõ, âðó÷íóþ íàäî àäðåñà ïðîïèñûâàòü â ôàéë /usr/local/etc/ethers Ïðè çàãðóçêå îí äîáàâëÿåòñÿ ê ñãåíåðåííîìó íà îñíîâàíèè âåáìîðäû /etc/ethers
âî-âòîðûõ, âû áû âñå òàêè èñïîëüçîâàëè êàíîíè÷åñêèé ôîðìàò ôàéëà ethers http://www.opennet.ru/man.shtml?topi...ry=5&russian=2 à íå èçîáðåòåííûé âàìè. Òîãäà è "ãëþêîâ" â ïðîøèâêå ãëÿäèøü ìåíüøå ñòàëî áû.

**YVM** · 11-06-2011, 12:29

Originally Posted by aivanov

ëó÷øå â post-mount, ÊÌÊ.

Ó ìåíÿ ýòîò ôîêóñ íå ïðîõîäèò. dnsmasq âñå ðàâíî ïîÿâëÿåòñÿ â ïðîöåññàõ, êàê Ôåíèêñ. Ìîæåò áûòü watchdog åãî âîñêðåøàåò?

Ñèòóàöèÿ ñëåäóþùàÿ. Óñòàíîâëåí bind, ò.ê. íóæíî êîíòðîëèòîâàòü ñâîþ çîíó. Named, êîãäà ñòàðòóåò, íå ñëóøàåò ïîðò tcp 53, òîëüêî udp ïîðòû 53. Âîçìîæíî, â ìîìåíò çàïóñêà tcp 53 çàíÿò dnsmasq. Ïîñëå ðó÷íîé ïåðåãðóçêè bind ïîäõâàûâàåò tcp 53 íà âíåøíåì èíòåðôåéñå. Êîíå÷íî, ìîæíî çàìóòèòü ÷òî-íèáóäü ÷åðåç cron, íî íåóæåëè íåò âîçìîæíîñòè óäàëÿòü ëèøíèå ïðîãðàììû èç àâòîçàãðóçêè (áåç ñàìîñòîÿòåëüíîé ñáîðêè ïîä ñåáÿ)?

**YVM** · 13-06-2011, 06:43

Îòâå÷àþ ñàì ñåáå. Ïîêà âñòàâèë â cron ñêðèïòèê:

#!/bin/bash
if [ `netstat -nl | grep -c \ 91.195.XXX.XXX:53` -gt 1 ]; then
echo 'bind ok';
else /opt/etc/init.d/S09named restart;
fi

Åñëè bind ñëóøàåò òîëüêî 1 ïîðò (udp), ïðîèñõîäèò ïåðåãðóçêà è ïîäõâàòûâàåòñÿ 2 ïîðò (tcp 53).

Ýòî íå ðåøåíèå ïðîáëåìû, íî ïîêà ðàáîòàåò.

**reiten** · 13-06-2011, 08:32

Ìîé íåìíîãî èçâðàòíûé âàðèàíò:
Ñèòóàöèÿ òàêàÿ: bind9 äëÿ êîíòðîëÿ ñâîåé çîíû, dnsmasq äëÿ îáåñïå÷åíèÿ ïîòðåáíîñòåé âíóòðåííåé ñåòè.
Ðåøåíèå: bind9 ñòàðòóåò íà äðóãîì ïîðòó (ó ìåíÿ - 553), à â post-firewall äîáàâëåíû âîò òàêèå ïðàâèëà:

Code:

iptables -t nat -A VSERVER -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.1.1:553
iptables -t nat -A VSERVER -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.1.1:553
iptables -I INPUT -p tcp -m tcp --dport 553 -j ACCEPT
iptables -I INPUT -p udp -m udp --dport 553 -j ACCEPT

Òàêèì îáðàçîì dnsmasq ðàçäàåò âî âíóòðåííåé ñåòè dhcp è ïðîêñèðóåò dns, à âî âíåøíåé ñåòè âèäåí named, óïðàâëÿþùèé íóæíûìè çîíàìè.

**YVM** · 13-06-2011, 20:08

Ñïàñèáî, äåéñòâèòåëüíî èíòåðåñíûé âàðèàíò. dnsmasq ñ âíóòðåííåé äîìàøíåé ñåòüþ âïîëíå ñïðàâëÿåòñÿ, äà è dhcp êàêîé-íèêàêîé.
Ïîäñêàæèòå, â ÷åì ñìûñë:
iptables -I INPUT -p tcp -m tcp --dport 553 -j ACCEPT
iptables -I INPUT -p udp -m udp --dport 553 -j ACCEPT
îòêðûâàåò 553 ïîðò íàðóæó? À çà÷åì?

**reiten** · 14-06-2011, 07:42

Çàòåì, ÷òî ïîñëå ïðîõîæäåíèÿ òàáëèöû -t NAT PREROUTING è ïðèìåíåíèÿ ê íèì DNAT, ïàêåòû ïîïàäàþò â òàáëèöó -t filter INPUT. Ïðè ýòîì â ïàêåòàõ destination óæå 192.168.1.1:553, à source - ip âíåøíåé ñåòè. Ñîîòâåòñòâåííî, åñëè èõ ÿâíî íå ðàçðåøèòü, îíè áóäóò ïîðåçàíû ôàéðâîëîì.

Ïîäðîáíóþ ñõåìó ïðîõîæäåíèÿ ïàêåòà ïî òàáëèöàì iptables ìîæíî ãëÿíóòü, íàïðèìåð, òóò: http://citforum.ru/operating_systems...ERSINGOFTABLES

**theMIROn** · 14-06-2011, 08:03

çàïóñêàéòå áèíä íà âíåøíåì èíòåðôåéñå, à dnsmasq - íà âíóòðåííåì
äëÿ ýòîãî â /etc/dnamsq.conf äîëæíî áûòü âîò ýòî

Code:

interface=br0
bind-interfaces

ïîäðîáíåå òóò http://www.thekelleys.org.uk/dnsmasq...q.conf.example

äëÿ òîãî, ÷òîáû àâòîìàòè÷åñêè äîïèñûâàòü ÷òî-ëèáî ê /etc/dnsmasq.conf, íóæíî ýòè äîáàâêè ïðîïèñàòü â ôàéëå /usr/local/etc/dnsmasq.conf è ñîõðàíèòü flashfs.

**YVM** · 14-06-2011, 08:14

Originally Posted by reiten

Çàòåì, ÷òî ïîñëå ïðîõîæäåíèÿ òàáëèöû -t NAT PREROUTING è ïðèìåíåíèÿ ê íèì DNAT, ïàêåòû ïîïàäàþò â òàáëèöó -t filter INPUT. Ïðè ýòîì â ïàêåòàõ destination óæå 192.168.1.1:553, à source - ip âíåøíåé ñåòè. Ñîîòâåòñòâåííî, åñëè èõ ÿâíî íå ðàçðåøèòü, îíè áóäóò ïîðåçàíû ôàéðâîëîì.

Ïîäðîáíóþ ñõåìó ïðîõîæäåíèÿ ïàêåòà ïî òàáëèöàì iptables ìîæíî ãëÿíóòü, íàïðèìåð, òóò: http://citforum.ru/operating_systems...ERSINGOFTABLES

Ñïàñèáî, çàïóñòèë, ïîëó÷èëîñü. Íàäî áû â FAQ äîáàâèòü. Ñóäÿ ïî ôîðóìó íå îäèí ÿ èñêàë âûõîä èç bind+dnsmasq.

**YVM** · 14-06-2011, 08:49

Originally Posted by theMIROn

çàïóñêàéòå áèíä íà âíåøíåì èíòåðôåéñå, à dnsmasq - íà âíóòðåííåì
äëÿ ýòîãî â /etc/dnamsq.conf äîëæíî áûòü âîò ýòî

Code:

interface=br0
bind-interfaces

ïîäðîáíåå òóò http://www.thekelleys.org.uk/dnsmasq...q.conf.example

äëÿ òîãî, ÷òîáû àâòîìàòè÷åñêè äîïèñûâàòü ÷òî-ëèáî ê /etc/dnsmasq.conf, íóæíî ýòè äîáàâêè ïðîïèñàòü â ôàéëå /usr/local/etc/dnsmasq.conf è ñîõðàíèòü flashfs.

Íàñêîëüêî ÿ ïîíèìàþ, åñëè /usr/local/etc/dnsmasq.conf íåò, åãî íóæíî ñîçäàòü? Ñîçäàë, âïèñàë, ñîõðàíèë - íå ïåðåíîñèò â /etc/dnsmasq.conf À åñëè íóæíî îòêëþ÷èòü, òî äîñòàòî÷íî ïðîïèñàòü port=0 ?

**theMIROn** · 14-06-2011, 09:15

Originally Posted by YVM

Íàñêîëüêî ÿ ïîíèìàþ, åñëè /usr/local/etc/dnsmasq.conf íåò, åãî íóæíî ñîçäàòü? Ñîçäàë, âïèñàë, ñîõðàíèë - íå ïåðåíîñèò â /etc/dnsmasq.conf À åñëè íóæíî îòêëþ÷èòü, òî äîñòàòî÷íî ïðîïèñàòü port=0 ?

ïðè çàïóñêå/ïåðåçàïóñêå dnsmasq äîïèøåòñÿ.
port=0 äà, âûêëþ÷èò dns

**YVM** · 14-06-2011, 19:07

Originally Posted by reiten

Ñîîòâåòñòâåííî, åñëè èõ ÿâíî íå ðàçðåøèòü, îíè áóäóò ïîðåçàíû ôàéðâîëîì.

553 äóáëèðóåò 53 ò.å. íè÷åãî ñòðàøíîãî, íî êàê-òî íå óþòíî, êîãäà ëèøíèé ïîðò òîð÷èò íàðóæó... Åùå ðàç ñïàñèáî.

ïðè çàïóñêå/ïåðåçàïóñêå dnsmasq äîïèøåòñÿ.

×òî-òî âèäèìî åùå íóæíî ñäåëàòü ò.ê. íå äîïèñûâàåòñÿ...

**theMIROn** · 14-06-2011, 20:40

Originally Posted by YVM

×òî-òî âèäèìî åùå íóæíî ñäåëàòü ò.ê. íå äîïèñûâàåòñÿ...

dnsmasq îáû÷íî çàïóñêàåòñÿ òîëüêî ïðè ñòàðòå ðîóòåðà.

**YVM** · 15-06-2011, 12:23

Originally Posted by theMIROn

dnsmasq îáû÷íî çàïóñêàåòñÿ òîëüêî ïðè ñòàðòå ðîóòåðà.

Ñïàñèáî, äîïèñûâàòü ïîëó÷èëîñü. Äåéñòâèòåëüíî, ðàáîòàåò îòëè÷íî. Ïðîâåðèë äåðæàòåëü äîìåíà - áåç çàìå÷àíèé.
Â FAQ ïî bind ìîäåðàòîðàì íóæíî áû äîáàâèòü.

**mixir** · 12-07-2011, 15:00

Ïîäñêàæèòå ïîæàëóéñòà êàê ìîæíî îáîéòè äàííóþ ïðîáëåìû? èìåþ ðîóòåð è ñåðâåð â ëîê ñåòè, ïîðòû 21, 80 è òä ïðîáðîñèëèñü íîðìàëüíî, ñåðâåð ðàáîòàåò, à 53 äëÿ íñ ñåðâåðà â ëî ñåòè íåò - èç âíåøêè îí âñåãäà çàêðûò, ÿ óæå ìíîãî ðàç ïûòàëñÿ íàñòðàèâàòü virtual server íè÷å íå ïîìîãàåò, ãðåøó íà âñòðîåííûé dnsmasq íî òîãäà ïî÷åìó 80 ïîðò ïðîðîñèëñÿ áåç ïðîáëåì ? ((

**reiten** · 12-07-2011, 18:24

Ñòðàííî. Åñëè âñå ñäåëàíî ïðàâèëüíî, äîëæíî ðàáîòàòü. Êàêàÿ ïðîøèâêà? 53-é ïîðò ïðîáðàñûâàåòñÿ è äëÿ tcp-, è äëÿ udp-ñîåäèíåíèé?

Êàê âàðèàíò - âïèñàòü â post-firewall

Code:

iptables -t nat -A VSERVER -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.1.x
iptables -t nat -A VSERVER -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.1.x

Íî ýòî êðàéíÿÿ ìåðà.

Thread: Íåñêîëüêî DNS è dnsmasq

Thread Tools

Rate This Thread

Display

Ïðîáðîñ 53 ïîðòà (DNS server)

Similar Threads

Ôèëüòðàöèÿ íåæåëàòåëüíîãî êîíòåíòà (dnsmasq+adsuck+dnscrypt)

Íåñêîëüêî âîïðîñîâ ïî Samba è USB HDD

problem with edited dnsmasq.conf

Dnsmasq, could this be a problem/security risk ?

New firmware - dnsmasq

Tags for this Thread

Posting Permissions