Bind9 Dengan DNS Over TLS - Dot Port 853
Sistem Nama Domain seperti Buku telepon Internet. Server DNS dapat menerjemahkan nama domain ke alamat IP hingga dapat dibaca oleh browser web, dan layanan lain akan dapat memuat sumber daya Internet, melalui jaringan server DNS yang terdesentralisasi.
DNS (Domain Name System), merupakan pilar dasar dari pengalaman internet di dunia maya, DNS memfasilitasi akses ke situs web. Namun, karena kueri DNS bersifat tradisional dikirim tanpa enkripsi, dapat menimbulkan kerentanan keamanan dan masalah privasi. Di sinilah DNS Over TLS hadir, menjawab semua tantangan tersebut. Teknologi ini bertujuan untuk memberi Anda pengalaman Internet yang lebih aman dan pribadi dengan mengenkripsi kueri DNS.
| Protokol | Port | Enkripsi |
|---|---|---|
| DNS over HTTPS (DoH) | 443 (HTTPS) | HTTPS (TLS) |
| DNS over TLS (DoT) | 853 | TLS |
| DNS Tradisional | 53 | Tanpa Enkripsi |
| DNS over QUIC (DoQ) | 853 | QUIC |
DNS Over TLS (DoT) mengirimkan kueri DNS secara langsung melalui protokol TLS. Protokol ini akan memisahkan lalu lintas DNS dari lalu lintas web lainnya melalui port khusus (853). DNS DOT biasanya diimplementasikan pada tingkat sistem operasi dan server.
Meskipun menawarkan manfaat keamanan yang mirip dengan DNS DoH, DOT memerlukan infrastruktur yang berbeda dan dukungannya lebih sedikit. Kedua teknologi tersebut mewakili kemajuan signifikan dalam perlindungan privasi pengguna dan pencegahan spoofing DNS.
A. Apa itu Enkripsi DNS?
DNS (Domain Name Server) adalah mesin server DNS yang bertugas menerjemahkan nama halaman web (https://unixbsdshell.site) ke alamat Ip tempatnya dihosting [2001:470:36:61c:4000::2005]. Sedangkan DNS DOT adalah protokol yang berupaya meningkatkan privasi dengan mengenkripsi kueri DNS. DNS DoT akan mengirimkan kueri DNS melalui TLS di port independen (853).
Enkripsi DNS dapat merujuk ke salah satu dari beberapa protokol, yang paling umum adalah DNSCrypt, DNSoverTLS, dan DNSoverHTTPS.
DNSCrypt adalah salah satu metode enkripsi pertama yang menanyakan DNS. DNSCrypt beroperasi pada port 443 dan bekerja dengan protokol transport, TCP atau UDP. DNSCrypt belum pernah dipresentasikan kepada Kelompok Kerja Internet Engineering task force (IETF), juga belum melalui proses Request for Comments (RFC), sehingga belum digunakan secara luas, dengan pengecualian beberapa implementasi. Akibatnya, sebagian besar telah diganti dengan DNS paling populer melalui HTTPS.
DNS over TLS adalah metode lain untuk mengenkripsi DNS komunikasi yang didefinisikan dalam RFC 7858. Dukungan ini diterapkan untuk pertama kalinya di Android 9, iOS 14, dan Linux di systemd, yang diselesaikan di versi 237. Preferensi dalam industri telah beralih dari DoT ke DoH dalam beberapa tahun terakhir, karena DoT adalah protokol yang kompleks dan memiliki variabel kepatuhan RFC di antara implementasi yang ada. DoT juga beroperasi pada port khusus 853, yang dapat diblokir dengan mudah oleh pembatasan firewall.
Hostname User dan Group
Artikel ini merupakan kelanjutan dari artikel sebelumnya tentang Cara Install DNS Bind9 Dengan Source Code di Debian dan Ubuntu. Biar tidak kesulitan memahami artikel ini, kami sarankan anda membaca artikel tersebut.
Sebelum anda mulai mengaktifkan port 853, tentukan terlebih dahulu nama host yang akan digunakan. Hal ini sangat penting, dan sering diabaikan oleh orang-orang yang baru belajar/mengenal server DNS.
Tentukan Nama HostName
Menurut saya bagian ini sangat penting, karena nama host yang akan berkomunikasi dengan dunia luar, selain IP address.
Nama Host digunakan untuk memetakan alamat IP address ke host. Hal ini akan memperjelas, bahwa alamat IP, misalnya 203.155.95.125
dijalankan pada komputer dengan Hostname dot.
Untuk mengaktifkan nama Hostname buka file /etc/hostname, dan ketikkan script di bawah ini.
doh
Pada file /etc/hosts, anda juga harus mengetikkan alamat IP address yang akan digunakan host tersebut.
192.168.17.7 doh.unixbsdshell.site doh
127.0.0.1 localhost
Pada skrip di atas 192.168.17.7 adalah IP address dari host doh, dengan nama domain unixbsdshell.site.
Mungkin anda bertanya, bagaimana dengan IP publik. Sama saja cara penulisan skrip, anda hanya mengganti alamat IP private dengan IP publik.
Tak ada yang beda, namun dalam artikel ini kami sengaja menggunakan IP private. Walaupun komputer kami sudah menggunakan IP publik.
Buat User bind
Bind9 berjalan pada hak istimewa, yang dikendalikan oleh user tertentu. User dan group ini akan menginisialisasi antara aplikasi dan pengguna.
Biasanya yang umum digunakan adalah user bind ataupun user named. Pada sistem operasi Debian biasanya menggunakan user dan group bind.
Pada Debian untuk membuat user dan group bind, cukup jalankan perintah berikut ini.
root@doh:~# groupadd bind
root@doh:~# useradd -d /usr/local/var/named -g bind -s /bin/false bind
B. Mengaktifkan Port 853 di Bind9
Langkah berikutnya adalah mengkonfigurasi Bind9. Karena artikel ini adalah kelanjutan dari artikel sebelumnya, pada artikel yang telah dipubliaksikan kita menginstall Bind9 dengan model kompilasi source code.
Setelah anda mengkompilasi Bind9, langkah selanjutnya adalah membuat folder untuk menempatkan semua file konfigurasi Bind9.
Buat File dan Direktori Yang Diperlukan Oleh BIND
Pada saat mengkompilasi, kita telah menentukan file named.conf dileatkkan di folder /usr/local/etc/namedb. Buat folder tersebut terlebih dahulu.
root@doh:~# install -d -m770 -o bind -g bind /usr/local/etc/namedb
root@doh:~# touch /usr/local/etc/namedb/named.conf
Sebelum kita mengutak-atik skrip file named.conf, sebaiknya kita buat sertifikat SSL untuk mempermudah proses konfigurasi.
Jalankan perintah di bawah ini untuk membuat sertifikat SSL bind9.
root@doh:~# install -d -m770 -o bind -g bind /usr/local/etc/namedb/ssl
root@doh:~# openssl req \
-newkey rsa:2048 \
-nodes \
-keyout /usr/local/etc/namedb/ssl/privkey.pem \
-x509 \
-days 36500 \
-out /usr/local/etc/namedb/ssl/certificate.pem \
-subj "/C=ID/ST=Jawa Barat/L=Bekasi/O=Mediatama/OU=Networking/CN=unixbsdshell.site/emailAddress=postmaster@unixbsdshell.site"
root@doh:~# openssl dhparam -out /usr/local/etc/namedb/ssl/dhparam.pem 3072
Untuk penggunaan sertifikat SSL, sangt disarankan anda menggunakan letsencrypt. Dengan sertifikat yang diterbitkan oleh letsencrypt
server DNS DOT anda tak hanya berjalan dilingkungan private, tapi juga bisa digunakan untuk kepentingan publik.
Langkah selanjutnya yang harus anda kerjakan adalah membuat beberapa folder dan file sebagai pendukung file named.conf.
Ada beberapa folder dan file yang harus anda buat, ikuti perintah di bawah ini untuk membuatnya.
Buat direktori/folder baru
root@doh:~# install -d -m770 -o bind -g bind /usr/local/etc/namedb/working
root@doh:~# install -d -m770 -o bind -g bind /usr/local/etc/namedb/primary
root@doh:~# install -d -m770 -o bind -g bind /usr/local/var/run/named
root@doh:~# install -d -m770 -o bind -g bind /usr/local/var/dump
root@doh:~# install -d -m770 -o bind -g bind /usr/local/var/stats
Buat file konfigurasi
root@doh:~# touch /usr/local/var/dump/named_dump.db
root@doh:~# touch /usr/local/var/stats/named.stats
root@doh:~# touch /usr/local/var/named/named_mem_stats.txt
root@doh:~# touch /usr/local/var/named/named.recursing
root@doh:~# touch /usr/local/var/named/named.secroots
root@doh:~# touch /usr/local/etc/namedb/primary/empty.db
root@doh:~# touch /usr/local/etc/namedb/primary/localhost-forward.db
root@doh:~# touch /usr/local/etc/namedb/primary/localhost-reverse.db
Jangan lupa buat kunci rndc.key
root@doh:~# rndc-confgen -a -b 512 -t /usr/local/etc/namedb
Setelah itu buat ijin kepemilikan dan penggunaan file.
root@doh:~# chown -R bind /usr/local/etc/namedb/working \
&& chown -R bind /var/dump \
&& chown -R bind /var/stats \
&& chown -R bind /usr/local/var/named
root@doh:~# chown -R bind /var/dump/named_dump.db \
&& chown -R bind /var/stats/named.stats \
&& chown -R bind /usr/local/var/named/named_mem_stats.txt \
&& chown -R bind /usr/local/var/named/named.recursing \
&& chown -R bind /usr/local/var/named/named.secroots \
&& chown -R bind /usr/local/etc/namedb/ssl \
&& chown -R bind /usr/local/etc/namedb/primary \
&& chown -R bind /usr/local/etc/namedb/rndc.key
Buat File named conf
File ini adalah otak dari Bind9, seluruh konfigurasi Bind9 diatur oleh file named.conf.
Di bawah ini kami berikan contoh SKRIP dari file /usr/local/etc/namedb/named.conf.
tls local-tls {
key-file "/usr/local/etc/namedb/ssl/privkey.pem";
cert-file "/usr/local/etc/namedb/ssl/certificate.pem";
dhparam-file "/usr/local/etc/namedb/ssl/dhparam.pem";
remote-hostname "ordns.he.net";
protocols { TLSv1.2; TLSv1.3; };
ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384"; // or whatever you consider acceptable
prefer-server-ciphers yes;
session-tickets no;
};
options {
directory "/usr/local/etc/namedb/working";
pid-file "/usr/local/var/run/named/pid";
session-keyfile "/usr/local/var/run/named/session.key";
dump-file "/usr/local/var/dump/named_dump.db";
statistics-file "/usr/local/var/stats/named.stats";
memstatistics-file "/usr/local/var/named/named_mem_stats.txt";
recursing-file "/usr/local/var/named/named.recursing";
secroots-file "/usr/local/var/named/named.secroots";
listen-on port 53 { 192.168.17.7; };
listen-on port 853 tls local-tls { 192.168.17.7; };
disable-empty-zone "255.255.255.255.IN-ADDR.ARPA";
disable-empty-zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";
disable-empty-zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";
dnssec-validation auto;
auth-nxdomain no;
response-padding { any; } block-size 468;
minimal-responses yes;
empty-zones-enable yes;
disable-empty-zone "home-arpa";
qname-minimization relaxed;
recursion yes;
allow-recursion { any; };
max-recursion-queries 256;
allow-query-on { any; };
querylog yes;
responselog yes;
allow-query-cache { any; };
allow-query { any; };
max-cache-size 241172480;
query-source address 192.168.17.7;
max-cache-ttl 600;
max-ncache-ttl 90;
clients-per-query 100;
max-clients-per-query 500;
tcp-listen-queue 10;
tcp-clients 1500;
edns-udp-size 4096;
max-udp-size 4096;
version "BIND 9.20.27";
zone-statistics yes;
allow-new-zones yes;
rrset-order {order random;};
//rrset-cache-size 200m;
forwarders port 853 tls local-tls { 2001:470:20::2; 2001:470:0:17c::2; };
};
zone "." { type hint; file "/usr/local/etc/namedb/root.hints"; };
// RFCs 1912, 5735 and 6303 (and BCP 32 for localhost)
zone "localhost" { type primary; file "/usr/local/etc/namedb/primary/localhost-forward.db"; };
zone "127.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/localhost-reverse.db"; };
zone "255.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
// RFC 1912-style zone for IPv6 localhost address (RFC 6303)
zone "0.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/localhost-reverse.db"; };
// "This" Network (RFCs 1912, 5735 and 6303)
zone "0.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
// Private Use Networks (RFCs 1918, 5735 and 6303)
zone "10.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "16.172.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "17.172.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "18.172.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "19.172.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "20.172.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "21.172.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "22.172.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "23.172.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "24.172.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "25.172.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "26.172.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "27.172.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "28.172.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "29.172.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "30.172.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "31.172.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "168.192.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
// Shared Address Space (RFC 6598)
zone "64.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "65.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "66.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "67.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "68.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "69.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "70.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "71.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "72.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "73.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "74.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "75.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "76.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "77.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "78.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "79.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "80.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "81.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "82.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "83.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "84.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "85.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "86.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "87.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "88.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "89.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "90.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "91.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "92.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "93.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "94.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "95.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "96.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "97.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "98.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "99.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "100.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "101.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "102.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "103.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "104.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "105.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "106.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "107.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "108.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "109.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "110.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "111.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "112.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "113.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "114.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "115.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "116.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "117.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "118.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "119.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "120.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "121.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "122.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "123.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "124.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "125.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "126.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "127.100.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
// Link-local/APIPA (RFCs 3927, 5735 and 6303)
zone "254.169.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
// IETF protocol assignments (RFCs 5735 and 5736)
zone "0.0.192.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
// TEST-NET-[1-3] for Documentation (RFCs 5735, 5737 and 6303)
zone "2.0.192.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "100.51.198.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "113.0.203.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
// IPv6 Example Range for Documentation (RFCs 3849 and 6303)
zone "8.b.d.0.1.0.0.2.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
// Router Benchmark Testing (RFCs 2544 and 5735)
zone "18.198.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "19.198.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
// IANA Reserved - Old Class E Space (RFC 5735)
zone "240.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "241.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "242.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "243.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "244.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "245.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "246.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "247.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "248.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "249.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "250.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "251.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "252.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "253.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "254.in-addr.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
// IPv6 Unassigned Addresses (RFC 4291)
zone "1.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "3.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "4.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "5.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "6.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "7.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "8.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "9.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "a.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "b.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "c.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "d.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "e.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "0.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "1.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "2.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "3.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "4.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "5.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "6.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "7.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "8.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "9.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "a.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "b.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "0.e.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "1.e.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "2.e.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "3.e.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "4.e.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "5.e.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "6.e.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "7.e.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
// IPv6 ULA (RFCs 4193 and 6303)
zone "c.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "d.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
// IPv6 Link Local (RFCs 4291 and 6303)
zone "8.e.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "9.e.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "a.e.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "b.e.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
// IPv6 Deprecated Site-Local Addresses (RFCs 3879 and 6303)
zone "c.e.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "d.e.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "e.e.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
zone "f.e.f.ip6.arpa" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
// IP6.INT is Deprecated (RFC 4159)
zone "ip6.int" { type primary; file "/usr/local/etc/namedb/primary/empty.db"; };
include "/usr/local/etc/namedb/rndc.key";
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};
Lanjutkan dengan membuat skrip untuk file empty.db, localhost-forward.db dan localhost-reverse.db.
Contoh skrip file /usr/local/etc/namedb/primary/empty.db
$TTL 3h
@ SOA @ nobody.localhost. 42 1d 12h 1w 3h
; Serial, Refresh, Retry, Expire, Neg. cache TTL
@ NS @
; Silence a BIND warning
@ A 127.0.0.1
Contoh skrip file /usr/local/etc/namedb/primary/localhost-forward.db
$TTL 3h
localhost. SOA localhost. nobody.localhost. 42 1d 12h 1w 3h
; Serial, Refresh, Retry, Expire, Neg. cache TTL
NS localhost.
A 127.0.0.1
AAAA ::1
Contoh skrip file /usr/local/etc/namedb/primary/localhost-reverse.db
$TTL 3h
@ SOA localhost. nobody.localhost. 42 1d 12h 1w 3h
; Serial, Refresh, Retry, Expire, Neg. cache TTL
NS localhost.
1.0.0 PTR localhost.
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 PTR localhost.
Buat File root zone
File root.hints adalah daftar server nama root. File ini harus diperbarui secara berkala dan memiliki dns key.
Salinan file root.hints dapat diperoleh dari https://www.internic.net/domain/named.root. Untuk detailnya, lihat "Manual Referensi Administrator BIND 9".
Pada artikel ini, kita akan menggunakan file root.hints dari b.root-servers.net. Untuk mendapatkan file tersebut, jalankan perintah berikut ini.
root@doh:~# dig @b.root-servers.net . axfr +onesoa +tls | grep -v DNSKEY > /usr/local/etc/namedb/root.hints
Buat File Systemd named service
File ini digunakan untuk menjalankan Bind9 secara otomatis pada saat komputer di restart. File ini berisi perintah untuk menjalankan server DNS Bind9.
Karena, kita menginstall Bind9 dengan cara kompilasi, maka letak file named.service, berada di folder /etc/systemd/system.
Di bawah ini adalah contoh dari skrip file /etc/systemd/system/named.service.
[Unit]
Description=BIND Domain Name Server
Documentation=man:named(8)
After=network.target
Wants=nss-lookup.target
Before=nss-lookup.target
[Service]
Restart=always
RestartSec=5s
# ## ExecStart=/usr/local/sbin/named -u bind -c /usr/local/etc/namedb/named.conf
ExecStart=/usr/local/sbin/named -u bind -c /usr/local/etc/namedb/named.conf -g -d 3
ExecReload=/usr/local/sbin/rndc reload
ExecStop=/usr/local/sbin/rndc stop
Restart=on-failure
[Install]
WantedBy=multi-user.target
Setelah anda membuat file tersebut, langsung aktifkan untuk menjalankan Bind9.
root@doh:~# systemctl enable named
root@doh:~# systemctl restart named
root@doh:~# systemctl status named
Langkah selanjutnya adalah mereload file rndc.key.
root@doh:~# rndc reload
root@doh:~# rndc status
C. Lakukan Pengujian Terhadap Server DNS Bind9
Setelah anda menjalankan perintah systemctl restart named, periksa apakah port 53 dan 853 telah terbuka.
root@doh:~# sockstat
Jika telah terbuka, artinya Bind9 sudah aktif. Sekarang kita lakukan pengujian, dengan perintah dig.
root@doh:~# dig yahoo.com +tls
; <<>> DiG 9.20.27 <<>> yahoo.com +tls
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37819
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 47fd5911cd157ab5010000006a9ade51018387f7eed583b6 (good)
;; QUESTION SECTION:
;yahoo.com. IN A
;; ANSWER SECTION:
yahoo.com. 600 IN A 74.6.231.21
yahoo.com. 600 IN A 98.137.11.164
yahoo.com. 600 IN A 74.6.143.25
yahoo.com. 600 IN A 74.6.231.20
yahoo.com. 600 IN A 74.6.143.26
yahoo.com. 600 IN A 98.137.11.163
;; Query time: 136 msec
;; SERVER: 192.168.17.7#853(192.168.17.7) (TLS)
;; WHEN: Fri Sep 04 08:05:53 PDT 2026
;; MSG SIZE rcvd: 162
root@doh:~#
Perhatikan pada skrip terakhir SERVER: 192.168.17.7#853(192.168.17.7) (TLS), ini menandakan permintaan DNS yahoo.com dijawab oleh server
192.168.17.7 pada port 853.
Perintah lainnya yang bisa anda gunakan untuk menguji server Bind9 adalah:
root@doh:~# dig @1.1.1.1 +tls facebook.com A
root@doh:~# dig tls://192.168.17.7 google.com
root@doh:~# dig tls://ordns.he.net google.com
Dengan mengikuti panduan ini, Anda telah berhasil menginstal dan mengonfigurasi Bind9 sebagai resolver DNS lokal di server Debian 13 Trixie Anda.
Anda telah mempelajari cara menyesuaikan berkas konfigurasi named.conf, mengaktifkan cache DNS, meningkatkan privasi dan keamanan, mengoptimalkan kinerja DNS Bind9, serta mengatur resolver DNS pada mesin klien.
DNS Bind9 menyediakan resolusi DNS yang andal dan efisien sembari mengutamakan privasi dan keamanan. Dengan adanya resolver DNS lokal ini, Anda dapat menikmati komunikasi jaringan yang lebih cepat dan lebih aman.