这是我之前问题的后续问题。以下是/etc/unbound/unbound.conf
文件:
# unbound.conf(5) config file for unbound(8).
server:
directory: "/etc/unbound"
username: "unbound"
chroot: ""
logfile: "/etc/unbound/unbound.log"
pidfile: "/etc/unbound/unbound.pid"
verbosity: 1
# listen on all interfaces and answer queries from the local port 3000.
interface: 0.0.0.0
interface: ::0
port: 3000
access-control: 10.0.0.0/8 allow
#access-control: 2001:DB8::/64 allow
开始时unbound.service
,我尝试dig
通过本地未绑定的服务器访问域:
root@DNS:/etc/unbound# dig example.com A @192.168.1.50 -p 3000
; <<>> DiG 9.18.28-0ubuntu0.24.04.1-Ubuntu <<>> example.com A @192.168.1.50 -p 3000
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 8367
;; flags: qr rd ad; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; Query time: 0 msec
;; SERVER: 192.168.1.50#3000(192.168.1.50) (UDP)
;; WHEN: Tue Oct 29 16:18:19 UTC 2024
;; MSG SIZE rcvd: 12
我不明白为什么 WARNING: recursion requested but not available
unbound 默认配置为递归解析器。另外。SERVER: 192.168.1.50#3000(192.168.1.50) (UDP)
显示使用了 unbound,但无法获取域。哪里出了问题,如何修复此问题?
下面显示了通过存根服务器的答案systemd-resolved.service
:
root@DNS:/etc/unbound# dig example.com
; <<>> DiG 9.18.28-0ubuntu0.24.04.1-Ubuntu <<>> example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36356
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;example.com. IN A
;; ANSWER SECTION:
example.com. 3304 IN A 93.184.215.14
;; Query time: 12 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Tue Oct 29 16:43:59 UTC 2024
;; MSG SIZE rcvd: 56
更新:
按照 @mpboden 的回答纠正子网后,该dig
命令仅起作用一次。为什么会这样?
root@DNS:/etc/unbound/unbound.conf.d# systemctl start unbound.service
root@DNS:/etc/unbound/unbound.conf.d# [1730230920] unbound[5780:0] notice: init module 0: subnetcache
[1730230920] unbound[5780:0] notice: init module 1: validator
[1730230920] unbound[5780:0] notice: init module 2: iterator
[1730230921] unbound[5780:0] info: start of service (unbound 1.19.2).
root@DNS:/etc/unbound/unbound.conf.d# dig example.com A @192.168.1.50 -p 3000
; <<>> DiG 9.18.28-0ubuntu0.24.04.1-Ubuntu <<>> example.com A @192.168.1.50 -p 3000
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40273
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;example.com. IN A
;; ANSWER SECTION:
example.com. 3600 IN A 93.184.215.14
;; Query time: 712 msec
;; SERVER: 192.168.1.50#3000(192.168.1.50) (UDP)
;; WHEN: Tue Oct 29 19:42:34 UTC 2024
;; MSG SIZE rcvd: 56
root@DNS:/etc/unbound/unbound.conf.d# dig google.com A @192.168.1.50 -p 3000
; <<>> DiG 9.18.28-0ubuntu0.24.04.1-Ubuntu <<>> google.com A @192.168.1.50 -p 3000
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 49774
;; flags: qr rd ad; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; Query time: 0 msec
;; SERVER: 192.168.1.50#3000(192.168.1.50) (UDP)
;; WHEN: Tue Oct 29 19:42:56 UTC 2024
;; MSG SIZE rcvd: 12
root@DNS:/etc/unbound/unbound.conf.d# dig example.com A @192.168.1.50 -p 3000
; <<>> DiG 9.18.28-0ubuntu0.24.04.1-Ubuntu <<>> example.com A @192.168.1.50 -p 3000
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 46236
;; flags: qr rd ad; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; Query time: 0 msec
;; SERVER: 192.168.1.50#3000(192.168.1.50) (UDP)
;; WHEN: Tue Oct 29 19:43:36 UTC 2024
;; MSG SIZE rcvd: 12
我看到您定义了以下内容:
access-control: 10.0.0.0/8 allow
但您的子网是
192.168.1.0/24
。将此行更改为:access-control: 192.168.1.0/24 allow
这将允许unbound接受来自 192.168.1.0/24 网络的 DNS 查询。