
Eu tenho um servidor multi-homed 'dhcp1' com interfaces de rede '192.168.10.151' (eth0) e '192.168.0.151' (eth1). A máquina está tentando usar DDNS com um servidor de nomes 'ns1' com interfaces de rede '192.168.10.131' (eth0) e '192.168.0.131' (eth1). Espero que estas sejam as seções relevantes do meu dhcpd.conf:
ddns-update-style interim;
key DHCP_UPDATER {
algorithm HMAC-MD5;
secret "A6...==";
};
# The 'private' network.
subnet 192.168.10.0 netmask 255.255.255.0 {
zone example.com. {
primary 192.168.10.131;
key DHCP_UPDATER;
}
zone 10.168.192.in-addr.arpa. {
primary 192.168.10.131;
key DHCP_UPDATER;
}
ddns-domainname "example.com.";
ddns-rev-domainname "in-addr.arpa.";
option domain-name "example.com";
host client-private {
hardware ethernet ...;
fixed-address 192.168.10.13;
}
...
}
# The 'public' network.
subnet 192.168.0.0 netmask 255.255.255.0 {
zone example.com. {
primary 192.168.0.131;
key DHCP_UPDATER;
}
zone 0.168.192.in-addr.arpa. {
primary 192.168.0.131;
key DHCP_UPDATER;
}
ddns-domainname "example.com.";
ddns-rev-domainname "in-addr.arpa.";
option domain-name "example.com";
host client-public {
hardware ethernet ...;
fixed-address 192.168.0.13;
}
...
}
O servidor 'ns1' executa duas instâncias de 'nomeado' - uma escutando nas interfaces de loopback e de rede privada, enquanto a outra instância escuta na interface pública.
Iniciar a primeira instância produz:
May 10 01:24:32 ns1 named[6610]: starting BIND 9.8.1-P1 -u bind
May 10 01:24:32 ns1 named[6610]: built with '--prefix=/usr' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--sysconfdir=/etc/bind' '--localstatedir=/var' '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared' '--enable-static' '--with-openssl=/usr' '--with-gssapi=/usr' '--with-gnu-ld' '--with-geoip=/usr' '--enable-ipv6' 'CFLAGS=-fno-strict-aliasing -DDIG_SIGCHASE -O2' 'LDFLAGS=-Wl,-Bsymbolic-functions -Wl,-z,relro' 'CPPFLAGS=-D_FORTIFY_SOURCE=2'
May 10 01:24:32 ns1 named[6610]: adjusted limit on open files from 4096 to 1048576
May 10 01:24:32 ns1 named[6610]: found 2 CPUs, using 2 worker threads
May 10 01:24:32 ns1 named[6610]: using up to 4096 sockets
May 10 01:24:32 ns1 named[6610]: loading configuration from '/etc/bind/named.conf'
May 10 01:24:32 ns1 named[6610]: reading built-in trusted keys from file '/etc/bind/bind.keys'
May 10 01:24:32 ns1 named[6610]: using default UDP/IPv4 port range: [1024, 65535]
May 10 01:24:32 ns1 named[6610]: using default UDP/IPv6 port range: [1024, 65535]
May 10 01:24:32 ns1 named[6610]: listening on IPv4 interface lo, 127.0.0.1#53
May 10 01:24:32 ns1 named[6610]: listening on IPv4 interface eth0, 192.168.10.131#53
May 10 01:24:32 ns1 named[6610]: generating session key for dynamic DNS
May 10 01:24:32 ns1 named[6610]: sizing zone task pool based on 7 zones
May 10 01:24:32 ns1 named[6610]: set up managed keys zone for view _default, file 'managed-keys.bind'
May 10 01:24:32 ns1 named[6610]: Warning: 'empty-zones-enable/disable-empty-zone' not set: disabling RFC 1918 empty zones
May 10 01:24:32 ns1 named[6610]: automatic empty zone: 254.169.IN-ADDR.ARPA
May 10 01:24:32 ns1 named[6610]: automatic empty zone: 2.0.192.IN-ADDR.ARPA
May 10 01:24:32 ns1 named[6610]: automatic empty zone: 100.51.198.IN-ADDR.ARPA
May 10 01:24:32 ns1 named[6610]: automatic empty zone: 113.0.203.IN-ADDR.ARPA
May 10 01:24:32 ns1 named[6610]: automatic empty zone: 255.255.255.255.IN-ADDR.ARPA
May 10 01:24:32 ns1 named[6610]: automatic empty zone: 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
May 10 01:24:32 ns1 named[6610]: automatic empty zone: 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
May 10 01:24:32 ns1 named[6610]: automatic empty zone: D.F.IP6.ARPA
May 10 01:24:32 ns1 named[6610]: automatic empty zone: 8.E.F.IP6.ARPA
May 10 01:24:32 ns1 named[6610]: automatic empty zone: 9.E.F.IP6.ARPA
May 10 01:24:32 ns1 named[6610]: automatic empty zone: A.E.F.IP6.ARPA
May 10 01:24:32 ns1 named[6610]: automatic empty zone: B.E.F.IP6.ARPA
May 10 01:24:32 ns1 named[6610]: automatic empty zone: 8.B.D.0.1.0.0.2.IP6.ARPA
May 10 01:24:32 ns1 named[6610]: command channel listening on 127.0.0.1#953
May 10 01:24:32 ns1 named[6610]: couldn't add command channel ::1#953: address not available
May 10 01:24:32 ns1 named[6610]: zone 0.in-addr.arpa/IN: loaded serial 1
May 10 01:24:32 ns1 named[6610]: zone 127.in-addr.arpa/IN: loaded serial 1
May 10 01:24:32 ns1 named[6610]: zone 10.168.192.in-addr.arpa/IN: loaded serial 2013092337
May 10 01:24:32 ns1 named[6610]: zone 255.in-addr.arpa/IN: loaded serial 1
May 10 01:24:32 ns1 named[6610]: zone localhost/IN: loaded serial 2
May 10 01:24:32 ns1 named[6610]: zone example.com/IN: loaded serial 2013092554
May 10 01:24:32 ns1 named[6610]: managed-keys-zone ./IN: loaded serial 59
May 10 01:24:32 ns1 named[6610]: zone example.com/IN: sending notifies (serial 2013092554)
May 10 01:24:32 ns1 named[6610]: zone 10.168.192.in-addr.arpa/IN: sending notifies (serial 2013092337)
May 10 01:24:32 ns1 named[6610]: running
Iniciar a segunda instância produz:
May 10 01:24:54 ns1 named[6635]: starting BIND 9.8.1-P1 -u bind -c /etc/bind/named-1.conf
May 10 01:24:54 ns1 named[6635]: built with '--prefix=/usr' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--sysconfdir=/etc/bind' '--localstatedir=/var' '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared' '--enable-static' '--with-openssl=/usr' '--with-gssapi=/usr' '--with-gnu-ld' '--with-geoip=/usr' '--enable-ipv6' 'CFLAGS=-fno-strict-aliasing -DDIG_SIGCHASE -O2' 'LDFLAGS=-Wl,-Bsymbolic-functions -Wl,-z,relro' 'CPPFLAGS=-D_FORTIFY_SOURCE=2'
May 10 01:24:54 ns1 named[6635]: adjusted limit on open files from 4096 to 1048576
May 10 01:24:54 ns1 named[6635]: found 2 CPUs, using 2 worker threads
May 10 01:24:54 ns1 named[6635]: using up to 4096 sockets
May 10 01:24:54 ns1 named[6635]: loading configuration from '/etc/bind/named-1.conf'
May 10 01:24:54 ns1 named[6635]: reading built-in trusted keys from file '/etc/bind/bind.keys'
May 10 01:24:54 ns1 named[6635]: using default UDP/IPv4 port range: [1024, 65535]
May 10 01:24:54 ns1 named[6635]: using default UDP/IPv6 port range: [1024, 65535]
May 10 01:24:54 ns1 named[6635]: listening on IPv4 interface eth1, 192.168.0.131#53
May 10 01:24:54 ns1 named[6635]: generating session key for dynamic DNS
May 10 01:24:54 ns1 named[6635]: sizing zone task pool based on 7 zones
May 10 01:24:54 ns1 named[6635]: set up managed keys zone for view _default, file 'managed-keys.bind'
May 10 01:24:54 ns1 named[6635]: Warning: 'empty-zones-enable/disable-empty-zone' not set: disabling RFC 1918 empty zones
May 10 01:24:54 ns1 named[6635]: automatic empty zone: 254.169.IN-ADDR.ARPA
May 10 01:24:54 ns1 named[6635]: automatic empty zone: 2.0.192.IN-ADDR.ARPA
May 10 01:24:54 ns1 named[6635]: automatic empty zone: 100.51.198.IN-ADDR.ARPA
May 10 01:24:54 ns1 named[6635]: automatic empty zone: 113.0.203.IN-ADDR.ARPA
May 10 01:24:54 ns1 named[6635]: automatic empty zone: 255.255.255.255.IN-ADDR.ARPA
May 10 01:24:54 ns1 named[6635]: automatic empty zone: 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
May 10 01:24:54 ns1 named[6635]: automatic empty zone: 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
May 10 01:24:54 ns1 named[6635]: automatic empty zone: D.F.IP6.ARPA
May 10 01:24:54 ns1 named[6635]: automatic empty zone: 8.E.F.IP6.ARPA
May 10 01:24:54 ns1 named[6635]: automatic empty zone: 9.E.F.IP6.ARPA
May 10 01:24:54 ns1 named[6635]: automatic empty zone: A.E.F.IP6.ARPA
May 10 01:24:54 ns1 named[6635]: automatic empty zone: B.E.F.IP6.ARPA
May 10 01:24:54 ns1 named[6635]: automatic empty zone: 8.B.D.0.1.0.0.2.IP6.ARPA
May 10 01:24:54 ns1 named[6635]: command channel listening on 192.168.0.131#953
May 10 01:24:54 ns1 named[6635]: zone 0.in-addr.arpa/IN: loaded serial 1
May 10 01:24:54 ns1 named[6635]: zone 127.in-addr.arpa/IN: loaded serial 1
May 10 01:24:54 ns1 named[6635]: zone 0.168.192.in-addr.arpa/IN: loaded serial 2013092346
May 10 01:24:54 ns1 named[6635]: zone 255.in-addr.arpa/IN: loaded serial 1
May 10 01:24:54 ns1 named[6635]: zone localhost/IN: loaded serial 2
May 10 01:24:54 ns1 named[6635]: zone example.com/IN: loaded serial 2013092573
May 10 01:24:54 ns1 named[6635]: managed-keys-zone ./IN: loaded serial 59
May 10 01:24:54 ns1 named[6635]: zone example.com/IN: sending notifies (serial 2013092573)
May 10 01:24:54 ns1 named[6635]: zone 0.168.192.in-addr.arpa/IN: sending notifies (serial 2013092346)
May 10 01:24:54 ns1 named[6635]: running
Todas as máquinas são virtuais e usam Ubuntu Server 12.04.
O problema
Minha expectativa é que quando o cliente solicitar um endereço IP na rede privada, 'dhcp1' atualizará 'ns1' na interface privada correspondente (ou seja, '192.168.10.131'). Também espero que 'dhcp1' atualize 'ns1' na interface pública '192.168.0.131' quando o cliente solicitar um endereço IP nessa rede. Embora as atualizações da zona reversa ocorram nas respectivas interfaces, 'dhcp1' sempre inicia as atualizações da zona direta de ambas as redes para a interface pública do servidor de nomes (ou seja, '192.168.0.131).
Estou fazendo algo errado, isso é um bug no isc-dhcp-server, um recurso, etc? Se eu não tiver fornecido informações específicas suficientes, por favor me avise. Pesquisas na Web sobre uma abordagem multi-homed usando isc-dhcp-server e bind9 não retornaram muito para mim.
Qualquer informação que você possa fornecer será apreciada. Obrigado.
Responder1
Parece que as zonas devem ser exclusivas na configuração.
Não consegui encontrar isso nas dhcpd.conf
páginas de manual, mas vasculhar o código e brincar com a configuração dá uma ideia da implementação do servidor:
- O código de análise 'dhcpd' atinge o primeiro "example.com". zone localizada na sub-rede '192.168.10.0' de 'dhcpd.conf' e adiciona as informações (incluindo o servidor de nomes primário) a um mapa hash, usando o nome da zona como chave.
- Mais tarde, a análise chega ao segundo “example.com”. zona localizada na
192.168.0.0
sub-rede. Neste ponto, o "example.com." existente. os dados da zona do mapa hash são substituídos pelas novas informações, incluindo o servidor de nomes primário. Como as zonas reversas são únicas, cada uma é adicionada ao mapa. - Quando o servidor DHCP precisar atualizar as informações da zona de encaminhamento para qualquer uma das sub-redes, as atualizações serão enviadas ao servidor de nomes primário da última sub-rede analisada – neste caso, o servidor DNS
192.168.0.131
.
A reorganização das informações da sub-rede no arquivo de configuração parece confirmar isso, pois todas as atualizações da zona de encaminhamento foram enviadas para 192.168.10.131
. Portanto, minha configuração pode exigir um dhcpd
daemon separado para cada interface, como fiz para o named
. Ainda estou curioso para saber se essa abordagem multi-homed para redes de alta disponibilidade é comum e se estou fazendo isso corretamente. Embora minha pergunta pareça ter sido respondida, qualquer conselho é bem-vindo.