Alhamdulillah kemarin baru saja menyelesaikan Zimbra Mail Server Network Edition :D Tapi ada yang berbeda dalam konfigurasi kali ini, karena konfigurasi kali ini menggunakan 2 interface dalam mesin Zimbra tersebut. Mengapa? Karena mail server running dengan bandwidth yang masih kecil (self managed), cuma 10Mbps, sedangkan akses ke mail server tersebut sangat banyak dan crowded. Jadi, untuk menghindari hal tersebut, saya memutuskan untuk membuat penipuan :))
Penipuan yang saya lakukan adalah membuat case sebagai berikut, apabila visitor datang dengan IP Range internal, maka dia akan mendapatkan dan mengirimkan menggunakan IP internal. Bingung? Berikut topologinya.
Mail Server Topology
Jadi apabila akses dari sisi internal, maka proses pengiriman email (attachment [send/receive]) dan beberapa proses email lainnya yang memakan resource internet yang sangat besar akan dilayani melalui jaringan internal (dalam kasus ini, semua nya akan terkoneksi ke IP 10.100.100.240)
Nah, bagaimana si DNS Mail Server bisa mengenali bahwa pengirim email dari internal? Berikut konfigurasi DNS nya. Mesin Zimbra menggunakan CentOS 6.2 dan menggunakan Bind Chroot.
File /etc/named.conf
// Dex tuned this shitz ;p~
options {
listen-on port 53 { 0.0.0.0/0; };
allow-query { 0.0.0.0/0; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
bindkeys-file "/etc/named.iscdlv.key";
/*
* If there is a firewall between you and nameservers you want
* to talk to, you might need to uncomment the query-source
* directive below. Previous versions of BIND always asked
* questions using port 53, but BIND 8.1 uses an unprivileged
* port by default.
*/
//query-source address * port 53;
};
logging {
channel custom {
file "/var/log/named.log" versions 5 size 5m;
severity debug 3;
print-severity no;
print-time yes;
print-category yes;
};
category config { custom; };
category notify { custom; };
category dnssec { custom; };
category general { custom; };
category security { custom; };
category xfer-out { custom; };
category lame-servers { custom; };
};
view "Internal"
{
match-clients { localhost; 10.100.0.0/16; 172.16.10.0/23; };
match-destinations { localhost; };
recursion yes;
zone "." IN {
type hint;
file "named.root";
};
zone "localdomain." IN {
type master;
file "localdomain.zone";
allow-update { none; };
};
zone "localhost." IN {
type master;
file "localhost.zone";
allow-update { none; };
};
zone "0.0.127.in-addr.arpa." IN {
type master;
file "named.local";
allow-update { none; };
};
zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." IN {
type master;
file "named.ip6.local";
allow-update { none; };
};
zone "255.in-addr.arpa." IN {
type master;
file "named.broadcast";
allow-update { none; };
};
zone "0.in-addr.arpa." IN {
type master;
file "named.zero";
allow-update { none; };
};
zone "yourdomain.tld" IN {
type master;
file "yourdomain.local.db";
allow-update { none; };
};
zone "100.100.10.in-addr.arpa" IN {
type master;
file "100.100.10.in-addr.arpa";
allow-update { none; };
};
};
view "Public"
{
recursion no;
zone "." IN {
type hint;
file "named.root";
};
zone "yourdomain.tld" IN {
type master;
file "yourdomain.tld.db";
allow-update { none; };
};
zone "xx.xx.202.in-addr.arpa" IN {
type master;
file "xx.xx.202.in-addr.arpa";
allow-update { none; };
};
};
include "/etc/rndc.key";
Kemudian, pada folder /var/named/ buat file database untuk record name servernya seperti contoh berikut ini.
File /var/named/yourdomain.tld.db akan digunakan untuk akses diluar internal network mail server
$TTL 1H @ SOA ns1 idk.yourdomain.tld. ( 1 3H 1H 1W 1H ) NS ns1 NS ns2 ns1 IN 1H A 202.xx.xx.219 ns2 IN 1H A 202.xx.xx.219 yourdomain.tld. IN A 117.xx.xx.251 yourdomain.tld. IN MX 5 mail.yourdomain.tld. yourdomain.tld. IN TXT "v=spf1 a:mail.yourdomain.tld ip4:202.xx.xx.219/32 ~all" mail IN 1H A 202.xx.xx.219 www IN 1H CNAME yourdomain.tld. smtp IN 1H CNAME mail.yourdomain.tld. imap IN 1H CNAME mail.yourdomain.tld. pop3 IN 1H CNAME mail.yourdomain.tld.
File /var/named/yourdomain.local.db akan digunakan untuk akses internal network mail server
$TTL 1H @ SOA ns1 idk.yourdomain.tld. ( 1 3H 1H 1W 1H ) NS ns1 NS ns2 ns1 IN 1H A 10.100.100.240 ns2 IN 1H A 10.100.100.240 yourdomain.tld. IN A 117.xx.xx.251 yourdomain.tld. IN MX 5 mail.yourdomain.tld. yourdomain.tld. IN TXT "v=spf1 a:mail.yourdomain.tld ip4:202.xx.xx.219/32 ~all" mail IN 1H A 10.100.100.240 www IN 1H CNAME yourdomain.tld. smtp IN 1H CNAME mail.yourdomain.tld. imap IN 1H CNAME mail.yourdomain.tld. pop3 IN 1H CNAME mail.yourdomain.tld.
File /var/named/100.100.10.in-addr.arpa akan digunakan untuk akses internal network mail server
$TTL 1H @ SOA ns1 idk.yourdomain.tld. ( 1 3H 1H 1W 1H ) NS ns1 NS ns2 ns1 IN 1H A 202.xx.xx.219 ns2 IN 1H A 202.xx.xx.219 219 IN 1H PTR mail.yourdomain.tld.
File /var/named/xx.xx.202.in-addr.arpa akan digunakan untuk akses internal network mail server
$TTL 1H @ SOA ns1 idk.yourdomain.tld. ( 1 3H 1H 1W 1H ) NS ns1 NS ns2 ns1 IN 1H A 202.xx.xx.219 ns2 IN 1H A 202.xx.xx.219 219 IN 1H PTR mail.yourdomain.tld.
Setelah memasukkan semua record ke dalam konfigurasi DNS, tinggal start named-nya. :)
Configured by Indra Kurniawan
No comments yet.