BIND 영역 전송, 응답 수신 중 실패: NXDOMAIN

이 문제에 대해 이틀 동안 고민한 끝에 이제 혼란스럽거나 뭔가를 놓치지 않도록 커뮤니티의 지원이 필요합니다. ((제 영어가 모국어가 아니니 양해해주세요.))

슬레이브 서버에서 계속 오류 메시지가 나타납니다.

Feb  9 14:28:15 orzech-pie named[7300]: client @0xffff9c0062c8 172.16.40.1#57648: received notify for zone 'llair.lan'
Feb  9 14:31:18 orzech-pie named[7300]: zone llair.lan/IN: Transfer started.
Feb  9 14:31:18 orzech-pie named[7300]: transfer of 'llair.lan/IN' from 172.16.40.1#53: connected using 172.16.40.1#53
Feb  9 14:31:18 orzech-pie named[7300]: transfer of 'llair.lan/IN' from 172.16.40.1#53: failed while receiving responses: NXDOMAIN
Feb  9 14:31:18 orzech-pie named[7300]: transfer of 'llair.lan/IN' from 172.16.40.1#53: Transfer status: NXDOMAIN
Feb  9 14:31:18 orzech-pie named[7300]: transfer of 'llair.lan/IN' from 172.16.40.1#53: Transfer completed: 0 messages, 0 records, 0 bytes, 0.023 secs (0 bytes/sec) (serial 0)

구성은 wireguard를 통해 연결된 2개 사이트 사이에서 이루어집니다. 마스터 사이트는 Debian 시스템이고 슬레이브 사이트는 Ubuntu 시스템입니다.

명명된.conf.옵션메인 서버:

options {
      directory "/var/lib/bind";
      version "Orzech! v15.2.1";

      // Disable empty zones
      empty-zones-enable no;

      // DoH Proxy Forwarder
      forwarders { 127.0.0.1 port 5053; };

      // ACL for zone transfer
      allow-transfer { any; };

      // No IPv6
      listen-on-v6 { none; };
      // Listen on these adresses
      listen-on port 53 { 172.16.40.1; 127.0.0.1; };

      // Added Per Debian buster Bind9.
      // Due to : resolver: info: resolver priming query complete messages in the logs.
      // See: https://gitlab.isc.org/isc-projects/bind9/commit/4a827494618e776a78b413d863bc23badd14ea42
      // minimal-responses no;

      //  AC for queries
      allow-query { any; };
      allow-query-cache { any; };

      //  AC for recursive queries
      recursion yes;
      allow-recursion { any; };

      // https://wiki.samba.org/index.php/Dns-backend_bind
      // DNS dynamic updates via Kerberos (optional, but recommended)
      tkey-gssapi-keytab "/var/lib/samba/private/dns.keytab";

  };

이름 .conf.local메인 서버 파일:

// Do any local configuration here
// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

include "/var/lib/samba/bind-dns/named.conf";

zone "llair.lan" IN {

     type master;

     file "/etc/bind/forward.llair.lan.db";

     allow-update { any; };
     also-notify { 172.16.69.252; }; //Notify slave for zone changes

};

앞으로.llair.lan.db메인 서버의 파일:

$ORIGIN llair.lan.
$TTL 86400
@               IN      SOA     domain-orzech.llair.lan.        webmaster.llair.lan. (
                                2024020901 ; serial
                                21600      ; refresh after 6 hours
                                3600       ; retry after 1 hour
                                604800     ; expire after 1 week
                                86400 )    ; minimum TTL of 1 day

; NS Records
                IN      NS      domain-orzech.llair.lan.
                IN      NS      orzech-pie.llair.lan.


; Nameserver IPs
domain-orzech   IN      A       172.16.40.1
orzech-pie      IN      A       172.16.69.252

; Single A Records
docker-orzech   IN      A       172.16.40.2
web-orzech      IN      A       172.16.40.3

; Multirecords
utm-orzech      IN      A       172.16.40.254
                IN      A       172.16.45.254

명명된.conf.옵션슬레이브 서버에서:

options {
      directory "/var/cache/bind";
      version "Orzech! v15.2.1";

      // Disable empty zones
      empty-zones-enable no;

      // DoH Proxy Forwarder
      forwarders { 127.0.0.1 port 5053; };

      // Listen on all IPv6 adresses
      listen-on-v6 { any; };
      // Listen on these adresses
      listen-on port 53 { 172.16.69.252; 127.0.0.1; };

      // Added Per Debian buster Bind9.
      // Due to : resolver: info: resolver priming query complete messages in the logs.
      // See: https://gitlab.isc.org/isc-projects/bind9/commit/4a827494618e776a78b413d863bc23badd14ea42
      //minimal-responses yes;

      //  AC for queries
      allow-query { any;  };
      allow-query-cache { any; };

      // AC for recursive queries
      recursion yes;
      allow-recursion {  any; };

  };

이름 .conf.local서버 파일에서:

//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

zone "llair.lan" IN {

     type slave;

     file "/var/cache/bind/forward.llair.lan.db";

     masters { 172.16.40.1; };

};

슬레이브 서버에서 dig를 실행하면 성공적인 쿼리가 발생합니다.

usr@orzech-pie:~$ dig @172.16.40.1 llair.lan

; <<>> DiG 9.18.18-0ubuntu0.22.04.1-Ubuntu <<>> @172.16.40.1 llair.lan
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7531
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: dbfabed0530373340100000065c631b364eaf777b7ab38b5 (good)
;; QUESTION SECTION:
;llair.lan.                     IN      A

;; AUTHORITY SECTION:
llair.lan.              86400   IN      SOA     domain-orzech.llair.lan. webmaster.llair.lan. 2024020901 21600 3600 604800 86400

;; Query time: 19 msec
;; SERVER: 172.16.40.1#53(172.16.40.1) (UDP)
;; WHEN: Fri Feb 09 15:07:47 CET 2024
;; MSG SIZE  rcvd: 126

내 실수는 어디에 있습니까? WireGuard 트래픽을 정규화하지 않고 있거나 구성에 문제가 있을 가능성이 있습니까? 이미 귀하의 지원에 감사드립니다.

편집: 모든 ACL을 비활성화하고 ACL로 교체했지만 여전히 성공하지 못했습니다.