Home / server / Questions / 491518
Accepted
Justin S
Asked: 2013-03-27 08:27:09 +0800 CST

BIND9 - Open Resolver

  • 772

I am running Ubuntu 12.04, and bind9. My Caching only DNS server was actually an open dns resolver, so I am trying to correct this.

I tried to follow this guide.

named.conf

// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
#include "/etc/bind/named.conf.default-zones";

named.conf.local just contains.

    //
    // Do any local configuration here
    //

    // Consider adding the 1918 zones here, if they are not used in your
    // organization
    //include "/etc/bind/zones.rfc1918";

named.conf.options

acl "trusted" {
        127.0.0.1/32;
        X.X.192.0/20;

};

options {
        recursion no;
        additional-from-cache no;
        allow-query { none; };
        dnssec-validation auto;
        auth-nxdomain no;    # conform to RFC1035
};

view "trusted" in {
        match-clients { trusted; };
        allow-query { trusted; };
        recursion yes;
        additional-from-cache yes;
        dnssec-validation auto;
        auth-nxdomain no;    # conform to RFC1035
};

I can restart bind without issue, I can query against bind. Yet, when i test I am still an open resolver, and when I look at DNS top, all my top queries are coming from IPs outside of the defined ranges. So I know I have something wrong.

ubuntu

1 Answers

  1. Best Answer

    This is what I use:

    options {
    directory "/var/named/master";
    allow-recursion { 127.0.0.1; x.y.z.0/19; ...; };
    allow-transfer { 127.0.0.1; x.y.z.0/19; ...;  };
    • 1