{"id":11744,"date":"2026-08-07T15:49:56","date_gmt":"2026-08-07T06:49:56","guid":{"rendered":"https:\/\/www.k-in.co.jp\/niwakan\/?p=11744"},"modified":"2026-08-10T17:45:54","modified_gmt":"2026-08-10T08:45:54","slug":"dns-firewall%e3%82%92%e4%bd%9c%e3%81%a3%e3%81%a6%e3%81%bf%e3%82%8b%ef%bc%88%e3%81%9d%e3%81%ae3%ef%bc%89","status":"publish","type":"post","link":"https:\/\/www.k-in.co.jp\/niwakan\/archives\/2026\/08\/11744\/","title":{"rendered":"DNS Firewall\u3092\u4f5c\u3063\u3066\u307f\u308b\uff08\u305d\u306e3\uff09"},"content":{"rendered":"<p><a href=\"https:\/\/www.k-in.co.jp\/niwakan\/archives\/2026\/07\/11695\/\">\u524d\u56de<\/a>\u3001DNSFirewall\u30921\u53f0\u306e\u7aef\u672b\u306b\u4e57\u305b\u305f\u3002<br \/>\n\u3053\u308c\u3092master(primary)\u306b\u3057\u3066\u3001mail &#038; web server\u5074\u3092slave(secoundary)\u3068\u3057\u3066\u52d5\u304b\u305d\u3046\u3002<br \/>\n\u3068\u3001\u3084\u3063\u3066\u307f\u305f\u3002<br \/>\n<!--more--><\/p>\n<p>\u3059\u308b\u3068\u3001\u3069\u3046\u3057\u305f\u3053\u3068\u3067\u3057\u3087\u3046\u3002\u6b62\u307e\u3063\u3066\u3057\u307e\u3044\u307e\u3057\u305f\u3002<br \/>\n\u7406\u7531\u306f\u7c21\u5358\u3067\u3057\u305f\u3002<br \/>\nowner\u304croot:wheel\u306a\u30d5\u30a1\u30a4\u30eb\u3060\u3089\u3051\u3067\u3057\u305f\u3002(^_^;;<br \/>\n\u3068\u8a00\u3046\u3053\u3068\u3067\u3001\u30ed\u30b0\u3082\u5410\u304b\u306a\u3044\u3057\u30c1\u30a7\u30c3\u30af\u304c\u3067\u304d\u306a\u3044\u3002<br \/>\n\u4f55\u6642\u3082\u306e\u901a\u308aGemini\u3055\u3093\u306b\u805e\u3044\u3066\u3001\u89e3\u6c7a\u7b56\u3092\u63a2\u308a\u307e\u3059\u3002<br \/>\nsudo named -g -u named<br \/>\n\u3068\u3057\u3066\u3001frontend\u3067\u52d5\u4f5c\u3055\u305b\u3001\u30b3\u30f3\u30bd\u30fc\u30eb\u306b\u30a8\u30e9\u30fc\u3092\u8868\u793a\u3055\u305b\u307e\u3057\u305f\u3002<\/p>\n<pre class=\"height:300 lang:default decode:true\" title=\"named log\">07-Aug-2026 14:58:58.221 not using config file logging statement for logging due to -g option\r\n07-Aug-2026 14:58:58.221 checking logging configuration failed: permission denied\r\n07-Aug-2026 14:58:58.222 loading configuration: permission denied\r\n07-Aug-2026 14:58:58.222 exiting (due to fatal error)<\/pre>\n<p>\u3069\u3063\u304b\u304c\u30d1\u30fc\u30df\u30c3\u30b7\u30e7\u30f3\u9055\u3044\u3067\u8aad\u307f\u66f8\u304d\u3067\u304d\u306a\u3044\u3001\u3068Gemini\u3055\u3093\u304c\u63a8\u6e2c\u3057\u3001\u7247\u7aef\u304b\u3089\u8abf\u3079\u307e\u3057\u305f\u3002<br \/>\n\u3059\u308b\u3068\u3001DNS Firewall\u95a2\u4fc2\u306e\u30d5\u30a1\u30a4\u30eb\u304c\u5168\u3066root:whell\u3060\u3063\u305f\u306e\u3067\u3057\u305f\u3002<br \/>\n\u6700\u7d42\u7684\u306b\u3001\u3053\u3053\u304c\u81f4\u547d\u7684\u3067\u3057\u305f\u3002<\/p>\n<pre class=\"height:300 lang:default decode:true\" title=\"rpz.log\">% ls -l \/opt\/local\/var\/log\/bind9\/rpz.log\r\n-rw-r--r--  1 root  wheel  22514  8  7 13:59 \/opt\/local\/var\/log\/bind9\/rpz.log<\/pre>\n<pre class=\"height:300 lang:default decode:true\" title=\"\">\r\n\u3053\u308c\u3058\u3083\u66f8\u304d\u8fbc\u3081\u306a\u3044\u2026\u2026\u2026\u2026\u2026\uff08sigh\uff09\r\n\u5e8f\u3067\u306b\u5b8c\u5168\u306aslave(secoundary)\u306b\u3057\u3066\u3057\u307e\u304a\u3046\u3002\r\n\u305f\u3060local.rpz\u3060\u3051\u306fmaster(primary)\u3068\u3057\u3066\u304a\u3053\u3046\u3002\uff08server\u5468\u308a\u306e\u30e1\u30f3\u30c6\u304c\u4e00\u53f0\u3067\u6e08\u3080\u304b\u3089\uff09\r\n\u3053\u3093\u306a\u98a8\u306b\u3001MASTER_ZONE_IPS\u306b\u96c6\u7d04\u3057\u3001MASTER_ZONE_IPS\u3092\u66f8\u304d\u63db\u3048\u308c\u3070\u4e00\u767a\u3067masters(primaries)\u3092\u5909\u3048\u3089\u308c\u308b\u69d8\u306b\u8a2d\u5b9a\u3002\r\n\u305d\u3046\u3057\u305f\u3089localnet\u5185\u304c\u5f15\u3051\u306a\u304f\u306a\u3063\u305f\u3002\uff08\u3069\u3046\u3057\u3066\u3060\uff1f\uff09\r\n<pre class=\"height:300 lang:default decode:true\" title=\"named.conf(slave)\">zone \"0.168.192.in-addr.arpa\" IN {\r\n        type    secondary;\r\n        file    \"db.0.168.192.in-addr.arpa\";\r\n        primaries { MASTER_ZONE_IPS; };\r\n        allow-transfer { none; };\r\n};\r\nprimaries \"MASTER_ZONE_IPS\" {\r\n        192.168.0.36;\r\n};<\/pre>\n<p>\u7406\u7531\u306f\u7c21\u5358\u3067\u3057\u305f\u3088\u3002<br \/>\nmaster(primary)\u5074\u306e\u8a2d\u5b9a\u3092\u3057\u3066\u3044\u306a\u304b\u3063\u305f\u304b\u3089\u3067\u3059\u3002<br \/>\n\u305d\u3063\u3061\u5074\u3082\u3001\u540c\u69d8\u306b\u3057\u306a\u3051\u308c\u3070\u3044\u3051\u306a\u304b\u3063\u305f\u3002<\/p>\n<pre class=\"height:300 lang:default decode:true\" title=\"named.conf(master)\">zone \"0.168.192.in-addr.arpa\" IN {\r\n        type    master;\r\n        file    \"db.0.168.192.in-addr.arpa\";\r\n        allow-transfer { SLAVE_ZONE_IPS; };\r\n        allow-update { none; };\r\n};\r\nacl \"SLAVE_ZONE_IPS\" {\r\n        192.168.0.35;\r\n};<\/pre>\n<p>acl\u3068\u8a00\u3046\u306e\u306f\u3053\u308c\u306f\u5b9a\u7fa9\u3059\u308b\u3063\u3066\u3053\u3068\u307f\u305f\u3044\u3002<br \/>\nslaves(secoundaries)\u306f\u3001masters(primaries)\u307f\u305f\u3044\u306b\u5b9a\u7fa9\u3055\u308c\u3066\u3044\u306a\u304b\u3063\u305f\u3002\u306a\u306e\u3067acl\u3002<\/p>\n<p>\u3053\u3046\u3057\u3066\u3001sudo rndc reload\u3057\u305f\u3089\u3001slave(secoundary)\u3082\u7121\u4e8b\u306b\u5f15\u3051\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3057\u305f\u3002<br \/>\n\u304a\u4ed5\u821e\u3044\u3002<\/p>\n<p>\u8ffd\u52a0<br \/>\nnamed\u304c\u52d5\u3044\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3001\u304d\u3061\u3093\u3068port 53\u3092\u76e3\u8996\u3057\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u78ba\u8a8d\u3057\u305f\u3044\u3001\u305d\u3046\u3057\u305f\u3044\u3002<br \/>\n\u3063\u3066\u3053\u3068\u3067\u3001Gemini\u3055\u3093\u306b<strong>lsof<\/strong>\u3092\u6559\u3048\u3066\u8cb0\u3063\u305f\u3002<\/p>\n<pre class=\"height:300 lang:default decode:true\" title=\"check port 53>% sudo lsof -i :53\r\nCOMMAND    PID     USER   FD   TYPE             DEVICE SIZE\/OFF NODE NAME\r\nperl5.34   628 _amavisd   18u  IPv4 0x6c57d4d66de5bacd      0t0  UDP macmini.lo.k-in.co.jp:51337->macmi2.lo.k-in.co.jp:domain\r\nperl5.34   629 _amavisd   18u  IPv4 0x6c57d4d66de5d08d      0t0  UDP macmini.lo.k-in.co.jp:34860->macmi2.lo.k-in.co.jp:domain\r\nnamed    22770    named   28u  IPv4 0x6c57d4d671005205      0t0  UDP localhost:domain\r\nnamed    22770    named   29u  IPv4 0x6c57d4d671005205      0t0  UDP localhost:domain\r\nnamed    22770    named   30u  IPv4 0x6c57d4d671005205      0t0  UDP localhost:domain\r\nnamed    22770    named   31u  IPv4 0x6c57d4d671005205      0t0  UDP localhost:domain\r\nnamed    22770    named   32u  IPv4 0x6c57d4d6776f6ed5      0t0  TCP localhost:domain (LISTEN)\r\nnamed    22770    named   34u  IPv4 0x6c57d4d6776f6ed5      0t0  TCP localhost:domain (LISTEN)\r\nnamed    22770    named   35u  IPv4 0x6c57d4d6776f6ed5      0t0  TCP localhost:domain (LISTEN)\r\nnamed    22770    named   36u  IPv4 0x6c57d4d6776f6ed5      0t0  TCP localhost:domain (LISTEN)\r\nnamed    22770    named   40u  IPv6 0x6c57d4d671004c95      0t0  UDP localhost:domain\r\nnamed    22770    named   41u  IPv6 0x6c57d4d671004c95      0t0  UDP localhost:domain\r\nnamed    22770    named   42u  IPv6 0x6c57d4d671004c95      0t0  UDP localhost:domain\r\nnamed    22770    named   43u  IPv6 0x6c57d4d671004c95      0t0  UDP localhost:domain\r\nnamed    22770    named   44u  IPv6 0x6c57d4d6772472fd      0t0  TCP localhost:domain (LISTEN)\r\nnamed    22770    named   45u  IPv6 0x6c57d4d6772472fd      0t0  TCP localhost:domain (LISTEN)\r\nnamed    22770    named   46u  IPv6 0x6c57d4d6772472fd      0t0  TCP localhost:domain (LISTEN)\r\nnamed    22770    named   47u  IPv6 0x6c57d4d6772472fd      0t0  TCP localhost:domain (LISTEN)\r\nnamed    22770    named   48u  IPv4 0x6c57d4d671007815      0t0  UDP macmini.lo.k-in.co.jp:domain\r\nnamed    22770    named   49u  IPv4 0x6c57d4d671007815      0t0  UDP macmini.lo.k-in.co.jp:domain\r\nnamed    22770    named   50u  IPv4 0x6c57d4d671007815      0t0  UDP macmini.lo.k-in.co.jp:domain\r\nnamed    22770    named   51u  IPv4 0x6c57d4d671007815      0t0  UDP macmini.lo.k-in.co.jp:domain\r\nnamed    22770    named   52u  IPv4 0x6c57d4d66fcb2b0d      0t0  TCP macmini.lo.k-in.co.jp:domain (LISTEN)\r\nnamed    22770    named   53u  IPv4 0x6c57d4d66fcb2b0d      0t0  TCP macmini.lo.k-in.co.jp:domain (LISTEN)\r\nnamed    22770    named   54u  IPv4 0x6c57d4d66fcb2b0d      0t0  TCP macmini.lo.k-in.co.jp:domain (LISTEN)\r\nnamed    22770    named   55u  IPv4 0x6c57d4d66fcb2b0d      0t0  TCP macmini.lo.k-in.co.jp:domain (LISTEN)<\/pre>\n<p>\u305d\u308c\u304b\u3089\u3001sudo named -g -unamed\u3057\u305f\u6642\u306b\u3001\u304d\u3061\u3093\u3068named\u3067\u52d5\u3044\u3066\u3044\u308b\u304b\u306e\u78ba\u8a8d\u3002<br \/>\n\u666e\u6bb5ps ax\u306f\u4f7f\u3046\u3051\u308c\u3069aux\u306f\u4f7f\u308f\u306a\u3044\u304b\u3089\u3001\u5fd8\u308c\u305f\u6642\u7528\u306b\u30b3\u30b3\u306b\u66f8\u3044\u3066\u304a\u304f\u3002\uff08\u591a\u5206\u3001\u305d\u306e\u6642\u306fGemini\u3055\u3093\u306b\u805e\u304f\uff09<\/p>\n<pre class=\"height:300 lang:default decode:true\" title=\"ps aux\">% ps aux | grep named\r\nnamed           22770   0.0  0.2  4391328  26480   ??  S     3:09PM   0:21.48 \/opt\/local\/sbin\/named -u named -f\r\nroot            22769   0.0  0.0  4288312   5540   ??  Ss    3:09PM   0:00.01 \/opt\/local\/bin\/daemondo --label=bind9 --start-cmd \/opt\/local\/sbin\/named -u named -f ; --restart-netchange --pid=exec\r\nnamed           22561   0.0  0.0  4305588   2912   ??  S     2:34PM   0:00.13 \/usr\/sbin\/distnoted agent\r\nnamed             881   0.0  0.1  4336056  10236   ??  S    \u672805PM   0:00.95 \/usr\/libexec\/trustd --agent<\/pre>\n<p>\u5f8c\u308d\u4e8c\u3064\u306f\u95a2\u4fc2\u306a\u3044\u3089\u3057\u3044\u3002apple\u306e\u4f55\u304b\u306e\u30b5\u30fc\u30d3\u30b9\u306a\u3093\u3060\u3063\u3066\u3002\uff08\u5f53\u7136\u3001Gemini\u3055\u3093\u306b\u805e\u3044\u305f\uff09<br \/>\n\u6700\u8fd1\u3001\u5168\u9762\u306e\u30e2\u30cb\u30bf\u306bterminal\u3092\u8907\u6570\u958b\u3044\u3066\u3001\u5de6\u306e\u30e2\u30cb\u30bf\u306bGemini\u3055\u3093\u3001\u53f3\u306e\u30e2\u30cb\u30bf\u306bGoogle AI\u3055\u3093\u7528\u306e\u30bf\u30d6\u3092\u958b\u3044\u3066\u3044\u308b\u3002<br \/>\n\u666e\u6bb5\u306fGemini\u3055\u3093\u3001\u716e\u8a70\u307e\u3063\u305f\u3089Google AI\u3055\u3093\u306b\u5c0b\u306d\u308b\u3053\u3068\u304c\u901a\u5e38\u5316\u3057\u3064\u3064\u3042\u308b\u3002\u5185\u7dd2\u3060\u3051\u3069\u306a\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u524d\u56de\u3001DNSFirewall\u30921\u53f0\u306e\u7aef\u672b\u306b\u4e57\u305b\u305f\u3002 \u3053\u308c\u3092master(primary)\u306b\u3057\u3066\u3001mail &#038; web server\u5074\u3092slave(secoundary)\u3068\u3057\u3066\u52d5\u304b\u305d\u3046\u3002 \u3068\u3001\u3084\u3063\u3066\u307f\u305f\u3002<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[246],"tags":[260,243],"class_list":["post-11744","post","type-post","status-publish","format-standard","hentry","category-my-macmini-server","tag-bind9","tag-dns"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.k-in.co.jp\/niwakan\/wp-json\/wp\/v2\/posts\/11744","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.k-in.co.jp\/niwakan\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.k-in.co.jp\/niwakan\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.k-in.co.jp\/niwakan\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.k-in.co.jp\/niwakan\/wp-json\/wp\/v2\/comments?post=11744"}],"version-history":[{"count":5,"href":"https:\/\/www.k-in.co.jp\/niwakan\/wp-json\/wp\/v2\/posts\/11744\/revisions"}],"predecessor-version":[{"id":11783,"href":"https:\/\/www.k-in.co.jp\/niwakan\/wp-json\/wp\/v2\/posts\/11744\/revisions\/11783"}],"wp:attachment":[{"href":"https:\/\/www.k-in.co.jp\/niwakan\/wp-json\/wp\/v2\/media?parent=11744"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.k-in.co.jp\/niwakan\/wp-json\/wp\/v2\/categories?post=11744"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.k-in.co.jp\/niwakan\/wp-json\/wp\/v2\/tags?post=11744"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}