# cat named.conf

// (oe) Loosely based on the document below and from production server configurations.

// http://www.cymru.com/Documents/secure-bind-template.html

//

// $Id: named.conf 418249 2009-08-19 18:33:42Z oden $

// $HeadURL: svn+ssh://svn.mandriva.com/svn/packages/cooker/bind/current/SOURCES/named.conf $

// secret must be the same as in /etc/rndc.conf

include "/etc/rndc.key";

controls {

inet 127.0.0.1 port 953

allow { 127.0.0.1; } keys { mykey; };

};

// Access lists (ACL's) should be defined here

// NOTE: the static bogon_acl.conf file has been deactivated per default but

// kept to serve as an example only. You should instead look at:

// http://www.team-cymru.org/Services/Bogons/

// include "/etc/bogon_acl.conf";

include "/etc/trusted_networks_acl.conf";

// Define logging channels

include "/etc/logging.conf";


// Enable statistics at http://127.0.0.1:5380/

statistics-channels {

inet 127.0.0.1 port 5380 allow { 127.0.0.1; };

};


options {

version "FigVam";

directory "/var/named";

dump-file "/var/tmp/named_dump.db";

pid-file "/var/run/named.pid";

statistics-file "/var/tmp/named.stats";

zone-statistics yes;

// datasize 256M;

coresize 100M;

// fetch-glue no;

// recursion no;

// recursive-clients 10000;

auth-nxdomain yes;

query-source address * port *;

listen-on port 53 { any; };

cleaning-interval 120;

transfers-in 20;

transfers-per-ns 2;

lame-ttl 0;

max-ncache-ttl 10800;

forwarders { 192.168.1.254; 8.8.8.8; 74.82.42.42; }; ### перенаправлять запросы на DNS-сервер провайдера (првайдер для нас локальная cisco, Google и ещё чей0то халявный)


// allow-update { none; };

// allow-transfer { any; };


// Prevent DoS attacks by generating bogus zone transfer

// requests. This will result in slower updates to the

// slave servers (e.g. they will await the poll interval

// before checking for updates).

notify no;

// notify explicit;

// also-notify { secondary_name_server };


// Generate more efficient zone transfers. This will place

// multiple DNS records in a DNS message, instead of one per

// DNS message.

transfer-format many-answers;


// Set the maximum zone transfer time to something more

// reasonable. In this case, we state that any zone transfer

// that takes longer than 60 minutes is unlikely to ever

// complete. WARNING: If you have very large zone files,

// adjust this to fit your requirements.

max-transfer-time-in 60;


// We have no dynamic interfaces, so BIND shouldn't need to

// poll for interface state {UP|DOWN}.

interface-interval 0;


// Uncoment these to enable IPv6 connections support

// IPv4 will still work

// listen-on { 127.0.0.1; 10.10.7.1 };

// listen-on-v6 { any; };


allow-query { 127.0.0.1; 10.10.7.0/27; }; ## от кого принимать запросы

allow-recursion { 127.0.0.1;10.10.7.0/27; }; ## кому отвечать на запросы


// Deny anything from the bogon networks as

// detailed in the "bogon" ACL.

// blackhole { bogon; };

};


// workaround stupid stuff... (OE: Wed 17 Sep 2003)

zone "ac" { type delegation-only; };

zone "cc" { type delegation-only; };

zone "com" { type delegation-only; };

zone "cx" { type delegation-only; };

zone "lv" { type delegation-only; };

zone "museum" { type delegation-only; };

zone "net" { type delegation-only; };

zone "nu" { type delegation-only; };

zone "ph" { type delegation-only; };

zone "sh" { type delegation-only; };

zone "tm" { type delegation-only; };

zone "ws" { type delegation-only; };


zone "." IN {

type hint;

file "named.ca";

};


zone "localdomain" IN {

type master;

file "master/localdomain.zone";

allow-update { none; };

};


zone "localhost" IN {

type master;

file "master/localhost.zone";

allow-update { none; };

};


zone "0.0.127.in-addr.arpa" IN {

type master;

file "reverse/named.local";

allow-update { none; };

};


zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {

type master;

file "reverse/named.ip6.local";

allow-update { none; };

};


zone "255.in-addr.arpa" IN {

type master;

file "reverse/named.broadcast";

allow-update { none; };

};


zone "0.in-addr.arpa" IN {

type master;

file "reverse/named.zero";

allow-update { none; };

};

// NOTE: You have to maintain this list yourself. In Mandriva Linux we allow

// the 192.168.0.0/16 network to do recursive lookups per default. If you

// don't like this you need to change this now.

//

// You may need to add specific ip addresses here as well.

//

// $Id: trusted_networks_acl.conf 80849 2007-09-06 11:56:48Z oden $

// $HeadURL: svn+ssh://svn.mandriva.com/svn/packages/cooker/bind/current/SOURCES/trusted_networks_acl.conf $

acl "trusted_networks" {

// If you are using RFC1918 netblocks please remember to

// comment these in the bogon_acl.conf file.

127.0.0.1;

10.10.7.0/27; ## тут наша локалка

// 192.168.0.0/16;

};

DEVICE=eth0

BOOTPROTO=static

IPADDR=192.168.1.7

NETMASK=255.255.255.0

GATEWAY=192.168.1.254

ONBOOT=yes

METRIC=10

MII_NOT_SUPPORTED=no

USERCTL=yes

DNS1=127.0.0.1

DNS2=192.168.1.254

RESOLV_MODS=no

IPV6INIT=no

IPV6TO4INIT=no

ACCOUNTING=no

#ddns-update-style none;

subnet 10.10.7.0 netmask 255.255.255.224 {

# default gateway

option routers 10.10.7.1;

option subnet-mask 255.255.255.224;


# option domain-name "domain.org";

######razdaem adress ntp server ua.pool.ntp.org

option ntp-servers 82.207.71.5;


# Seting up an ip address is better here

option domain-name-servers 10.10.7.1; ####

# option nis-domain "domain.org";


range dynamic-bootp 10.10.7.2 10.10.7.25;

default-lease-time 21600;

max-lease-time 43200;

}


# we want the nameserver to appear at a fixed address

host mustang {

hardware ethernet 00:1B:FC:84:D3:AF;

fixed-address 10.10.7.12;

}

и.т.д.

; DiG 9.7.0-P2 zoom.skynet.net.ua

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46366

;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 8, ADDITIONAL: 0


;; QUESTION SECTION:

;zoom.skynet.net.ua. IN A


;; ANSWER SECTION:

zoom.skynet.net.ua. 3600 IN A 193.160.224.18


;; AUTHORITY SECTION:

ua. 172799 IN NS ns-ua.ripe.net.

ua. 172799 IN NS cd1.ns.ua.

ua. 172799 IN NS he1.ns.ua.

ua. 172799 IN NS ya1.ns.ua.

ua. 172799 IN NS pch.ns.ua.

ua. 172799 IN NS sns-pb.isc.org.

ua. 172799 IN NS sunic.sunet.se.

ua. 172799 IN NS ho1.ns.ua.

; DiG 9.7.0-P2 zoom.skynet.net.ua

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63862

;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 8, ADDITIONAL: 0


;; QUESTION SECTION:

;zoom.skynet.net.ua. IN A


;; ANSWER SECTION:

zoom.skynet.net.ua. 3599 IN A 193.160.224.18


;; AUTHORITY SECTION:

ua. 172798 IN NS cd1.ns.ua.

ua. 172798 IN NS ns-ua.ripe.net.

ua. 172798 IN NS pch.ns.ua.

ua. 172798 IN NS sns-pb.isc.org.

ua. 172798 IN NS ho1.ns.ua.

ua. 172798 IN NS sunic.sunet.se.

ua. 172798 IN NS ya1.ns.ua.

ua. 172798 IN NS he1.ns.ua.