实现Internet 的DNS 服务架构

实现Internet 的DNS 服务架构

实验目的

环境要求

需要8台主机
DNS客户端：10.0.0.58/24
本地缓存DNS服务器：10.0.0.59/24
转发目标DNS服务器：10.0.0.60/24
根DNS服务器：10.0.0.61/24
子域DNS服务器：10.0.0.62/24
二级域主DNS服务器：10.0.0.63/24
二级域从DNS服务器：10.0.0.64/24
WEB服务器：10.0.0.65/24

前提准备

关闭SElinux
关闭防火墙
时间同步
DNS服务器清空DNS配置

配置WEB服务器

[root@WEB ~]# yum -y install httpd
[root@WEB ~]# echo www.george.org > /var/www/html/index.html
[root@WEB ~]# systemctl enable --now httpd
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.

配置客户端

[root@client ~]# yum -y install bind-utils
[root@client ~]# vim /etc/resolv.conf
[root@client ~]# cat /etc/resolv.conf 
# Generated by NetworkManager
nameserver 10.0.0.59         #配置本地缓存DNS服务器

配置本地缓存DNS服务器

[root@local ~]# yum -y install bind ;systemctl enable --now named
[root@local ~]# vim /etc/named.conf
options {
//      listen-on port 53 { 127.0.0.1; };           #//注释此行
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
//      allow-query     { localhost; };            #//注释此行
        forward only;      #转发模式设置only
        forwarders {10.0.0.60;};    #代理指向转发目标的DNS服务器

		
		dnssec-enable no;             #关闭DNS安全
        dnssec-validation no;

[root@local ~]# named-checkconf    #检查配置文件语法
[root@local ~]# rndc reload    	#重启配置
server reload successful

配置转发目标的DNS服务器

[root@forward ~]# yum -y install bind ;systemctl enable --now named
[root@forward ~]# vim /etc/named.conf
options {
//      listen-on port 53 { 127.0.0.1; };       #//注释此行
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
//      allow-query     { localhost; };        #//注释此行

[root@forward ~]# vim /var/named/named.ca
.                       518400  IN      NS      a.root-servers.net.
a.root-servers.net.     518400  IN      A       10.0.0.61      #把转发的目标指向根DNS服务器

[root@forward ~]# rndc reload    #重启配置
server reload successful

配置根DNS服务器

[root@root ~]# yum -y install bind ;systemctl enable --now named
[root@root ~]# vim /etc/named.conf
options {
//      listen-on port 53 { 127.0.0.1; };       #//注释此行
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
//      allow-query     { localhost; };       #//注释此行

zone "." IN {
        type master;
        file "root.zone";
};

[root@root ~]# cp -p /var/named/named.localhost /var/named/root.zone   #按照原有文件格式属性配置
[root@root ~]# vim /var/named/root.zone
$TTL 1D
@	IN SOA	master admin.george.org. (
					1	; serial
					1D	; refresh
					1H	; retry
					1W	; expire
					3H )	; minimum
	    NS  master
org     NS  orgns
master	A	10.0.0.61
orgns	A	10.0.0.62       #指向子域DNS服务器

[root@root ~]# rndc reload    #重启配置
server reload successful

配置子域DNS服务器

[root@org ~]# yum -y install bind ;systemctl enable --now named
[root@org ~]# vim /etc/named.conf
options {
//      listen-on port 53 { 127.0.0.1; };       #//注释此行
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
//      allow-query     { localhost; };       #//注释此行

zone "org" {           #加上这段
        type master;
        file "org.zone";
};

[root@org ~]# cp -p /var/named/named.localhost /var/named/org.zone  #按照原有文件格式属性配置
[root@org ~]# vim /var/named/org.zone
$TTL 1D
@       IN SOA  master admin.george.org. (
                                        1       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
          NS    master
george    NS    georgens1
george    NS    georgens2
master    A     10.0.0.62
georgens1 A     10.0.0.63       #指向主DNS服务器
georgens2 A     10.0.0.64       #指向从DNS服务器

[root@org ~]# rndc reload   #重启配置
server reload successful

配置二级域主DNS服务器

[root@MASTER ~]# yum -y install bind ;systemctl enable --now named
[root@MASTER ~]# vim /etc/named.conf 
options {
//      listen-on port 53 { 127.0.0.1; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
//      allow-query     { localhost; };
        allow-transfer  { 10.0.0.64;};     #添加此行，只允许从服务器进行区域传输

[root@MASTER ~]# vim /etc/named.rfc1912.zones
zone "george.org" {                          #加上这段
        type master;
        file "george.org.zone";
};

[root@MASTER ~]# vim /var/named/george.org.zone
$TTL 1D
@       IN SOA  master admin.george.org. (
                                        1       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      master
        NS      slave
master  A       10.0.0.63     
slave   A       10.0.0.64     #指向从NDS服务器
www     A       10.0.0.65     #指向WEB服务器

[root@MASTER ~]# rndc reload     #重启配置
server reload successful

配置二级域从DNS服务器

[root@SLAVE ~]# yum -y install bind ;systemctl enable --now named
[root@SLAVE ~]# vim /etc/named.conf
//      listen-on port 53 { 127.0.0.1; };       #//注释此行
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
//      allow-query     { localhost; };       #//注释此行
        allow-transfer  { none;};        #添加此行，不允许其他主机进行区域传输
        
[root@SLAVE ~]# vim /etc/named.rfc1912.zones        
zone "george.org" {                   #加上这段
        type slave;
        masters { 10.0.0.63;};
        file "slaves/george.org.slave";
};

[root@SLAVE ~]# rndc reload    #重启配置
server reload successful
[root@SLAVE slaves]# ll /var/named/slaves/george.org.slave   #查看区域数据库文件是否生成
-rw-r--r-- 1 named named 319 Sep 14 23:19 /var/named/slaves/george.org.slave 

客户机端测试

[root@client ~]# cat /etc/resolv.conf 
# Generated by NetworkManager
nameserver 10.0.0.59
[root@client ~]# dig www.george.org

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7 <<>> www.george.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29212
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.george.org.			IN	A

;; ANSWER SECTION:
www.george.org.		86178	IN	A	10.0.0.65      #有应答回去就成功了

;; Query time: 1 msec
;; SERVER: 10.0.0.59#53(10.0.0.59)
;; WHEN: Tue Sep 15 08:49:23 CST 2020
;; MSG SIZE  rcvd: 59

[root@client ~]# curl www.george.org
www.george.local