配置Bind主从及OpenRestry反向代理Bing解析

最新推荐文章于 2024-06-29 15:38:33 发布

老芦IT

最新推荐文章于 2024-06-29 15:38:33 发布

阅读量931

点赞数 20

文章标签： linux 运维

本文链接：https://blog.csdn.net/cnluxiansheng/article/details/135792545

版权

配置Bind主从及OpenRestry反向代理Bing解析

角色	ip	系统版本	内核	软件包
Bind主服务器	192.168.8.158	CentOS Stream 9	5.14.0- 381.el9.x86_64	bind-9.16.23-14.el9.src.rpm
Bind从服务器	192.168.8.157	CentOS Stream 9	5.14.0- 381.el9.x86_64	bind-9.16.23-14.el9.src.rpm
OpenRestry反向代理服务器	192.168.8.159	CentOS Stream 9	5.14.0- 381.el9.x86_64	openresty-1.25.3.1
OpenRestry反向代理服务器	192.168.8.160	CentOS Stream 9	5.14.0- 381.el9.x86_64	openresty-1.25.3.1

下载

首先在158和159主机上下载bind和bind-utils

yum -y install bind-utils bind

如果下载较慢的话使用清华大学的yum源

清华大学源地址

Index of /centos-stream/9-stream/ | 清华大学开源软件镜像站 | Tsinghua Open Source Mirror

cd /etc/yum.repos.d/

创建bak

mkdir bak

移动

mv -pv * bak/

ls -lhrt

vim base.repo

填入如下内容

[root@localhost yum.repos.d]# cat centos.repo

[baseos]

name=CentOS Stream $releasever - BaseOS

#mirrorlist=http://mirrorlist.centos.org/?release=$stream&arch=$basearch&repo=BaseOS&infra=$infra

baseurl=https://mirrors.ustc.edu.cn/centos-stream/9-stream/BaseOS/$basearch/os/

gpgcheck=1

enabled=1

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial

[appstream]

name=CentOS Stream $releasever - AppStream

#mirrorlist=http://mirrorlist.centos.org/?release=$stream&arch=$basearch&repo=AppStream&infra=$infra

baseurl=https://mirrors.ustc.edu.cn/centos-stream/9-stream/AppStream/$basearch/os/

gpgcheck=1

enabled=1

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial

配置完成之后

yum clean all

清除所有缓存

yum makecache

重新生成缓存

查看该命令在哪里

[root@dns-master190 ~]# which named-checkconf

/usr/sbin/named-checkconf

查看该命令来自那个安装包

[root@dns-master190 ~]# rpm -qf `which named-checkconf`

bind-9.16.23-14.el9.x86_64

配置158主机的配置文件

[root@rsync-158 named]# cat /etc/named.conf

// named.conf

// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS

// server as a caching only nameserver (as a localhost DNS resolver only).

// See /usr/share/doc/bind*/sample/ for example named configuration files.

options {

listen-on port 53 { 127.0.0.1; 192.168.8.158; };

//这里就是配置设置的本机127和本机ip地址的53端口

listen-on-v6 port 53 { ::1; };

directory "/var/named";

dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

secroots-file "/var/named/data/named.secroots";

recursing-file "/var/named/data/named.recursing";

allow-query { localhost; 192.168.8.0/24; };

//设置允许本机和8网段的地址可以解析

- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.

- If you are building a RECURSIVE (caching) DNS server, you need to enable

recursion.

- If your recursive DNS server has a public IP address, you MUST enable access

control to limit queries to your legitimate users. Failing to do so will

cause your server to become part of large scale DNS amplification

attacks. Implementing BCP38 within your network would greatly

reduce such attack surface

recursion yes;

dnssec-validation yes;

managed-keys-directory "/var/named/dynamic";

geoip-directory "/usr/share/GeoIP";

pid-file "/run/named/named.pid";

session-keyfile "/run/named/session.key";

/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */

include "/etc/crypto-policies/back-ends/bind.config";

};

logging {

channel default_debug {

file "data/named.run";

severity dynamic;

};

zone "." IN {

type hint;

file "named.ca";

};

zone "ldp.com" IN {

type master;

file "ldp.com.zone";

also-notify { 192.168.8.157 ;};

allow-transfer { 192.168.8.157 ;};

allow-update { none; };

notify yes;

//这里就是设置本机为主服务器，从服务器指向157主机，解析记录是/var/named/ldp.com.zone这个文件

};

include "/etc/named.rfc1912.zones";

include "/etc/named.root.key";

配置/var/named/ldp.com.zone文件

[root@rsync-158 named]# touch /var/named/ldp.com.zone

cat /var/named/ldp.com.zone

$TTL 7200

ldp.com. IN SOA ldp.com. 2043565830.qq.com. (

2024012312

10M

1D )

ldp.com. IN NS ns1.ldp.com.

ldp.com. IN NS ns2.ldp.com.

ns1.ldp.com. IN A 192.168.8.157

ns2.ldp.com. IN A 192.168.8.158

www.ldp.com. IN A 192.168.8.157

www.ldp.com. IN A 192.168.8.158

www.ldp.com. IN A 192.168.8.159

www.ldp.com. IN A 192.168.8.160

www.ldp.com. IN A 192.168.8.161

配置属主和属组

chown -R named.ldp.com.zone

检测配置是否正确

[root@rsync-158 ~]# cd /var/named/

[root@rsync-158 named]# named-checkzone ldp.com ldp.com.zone

zone ldp.com/IN: loaded serial 2024012312

启动

systemctl start named

查看端口

udp的53端口是提供域名解析服务的，tcp的53是提供bind服务的

将网卡文件的DNS 记录注释

之后执行nmcli c reload和nmcil c up ens160

进入配置/etc/resolv.conf文件

[root@rsync-158 named]# cat /etc/resolv.conf

# Generated by NetworkManager

nameserver 192.168.8.158

nameserver 192.168.8.157

指向本机和从服务器

测试

127.0.0.1

192.168.8.158

localhost

测试完成都可解析

157主机的配置文件

// named.conf

// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS

// server as a caching only nameserver (as a localhost DNS resolver only).

// See /usr/share/doc/bind*/sample/ for example named configuration files.

options {

listen-on port 53 { 127.0.0.1;192.168.8.157; };

// 这里就是配置设置的本机127和本机ip地址的53端口

listen-on-v6 port 53 { ::1; };

directory "/var/named";

dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

secroots-file "/var/named/data/named.secroots";

recursing-file "/var/named/data/named.recursing";

allow-query { localhost;192.168.8.0/24; };

//设置允许本机和8网段的地址可以解析

- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.

- If you are building a RECURSIVE (caching) DNS server, you need to enable

recursion.

- If your recursive DNS server has a public IP address, you MUST enable access

control to limit queries to your legitimate users. Failing to do so will

cause your server to become part of large scale DNS amplification

attacks. Implementing BCP38 within your network would greatly

reduce such attack surface

recursion yes;

dnssec-validation yes;

managed-keys-directory "/var/named/dynamic";

geoip-directory "/usr/share/GeoIP";

pid-file "/run/named/named.pid";

session-keyfile "/run/named/session.key";

/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */

include "/etc/crypto-policies/back-ends/bind.config";

};

logging {

channel default_debug {

file "data/named.run";

severity dynamic;

};

zone "." IN {

type hint;

file "named.ca";

};

zone "ldp.com" IN {

type slave;

file "slaves/ldp.com.zone";

masters { 192.168.8.158; };

masterfile-format text;

};

// 这里就是设定域名为ldp.com，角色为从（slave），同步的配置文件在当前路径下的slaves/ldp.com.zone

include "/etc/named.rfc1912.zones";

include "/etc/named.root.key";

将网卡文件的DNS 记录注释

之后执行nmcli c reload和nmcil c up ens160

进入配置/etc/resolv.conf文件

[root@rsync-158 named]# cat /etc/resolv.conf

# Generated by NetworkManager

nameserver 192.168.8.158

nameserver 192.168.8.157

指向主服务器和本机

重启158和157主机的named服务之后就可以看到157主机的解析记录同步过来了。

[root@rsync-157 ~]# cat /var/named/slaves/ldp.com.zone

$ORIGIN .

$TTL 7200 ; 2 hours

ldp.com IN SOA ldp.com. 2043565830.qq.com. (

2024012312 ; serial

3600 ; refresh (1 hour)

600 ; retry (10 minutes)

604800 ; expire (1 week)

86400 ; minimum (1 day)

)

NS ns1.ldp.com.

NS ns2.ldp.com.

$ORIGIN ldp.com.

ns1 A 192.168.8.157

ns2 A 192.168.8.158

www A 192.168.8.157

A 192.168.8.158

A 192.168.8.159

A 192.168.8.160

A 192.168.8.161

bind配置完成

OpenRestry 代理 Bind-主从模式

159和160主机下载包

wget -c https://openresty.org/download/openresty-1.25.3.1.tar.gz

159和160主机安装依赖

yum -y install perl-devel openssl-devel pcre-devel gcc gcc-c++ autoconf make zlib-devel

159和160主机解压

tar xf openresty-1.25.3.1.tar.gz

直接预编译

./configure ; echo $?

编译并安装

make && make install ; echo $?

配置159主机配置文件

[root@op-159 openresty-1.25.3.1]# cat /usr/local/openresty/nginx/conf/nginx.conf

#user nobody;

worker_processes 1;

#error_log logs/error.log;

#error_log logs/error.log notice;

#error_log logs/error.log info;

#pid logs/nginx.pid;

events {

worker_connections 1024;

}

http {

include mime.types;

default_type application/octet-stream;

#log_format main '$remote_addr - $remote_user [$time_local] "$request" '

# '$status $body_bytes_sent "$http_referer" '

# '"$http_user_agent" "$http_x_forwarded_for"';

#access_log logs/access.log main;

sendfile on;

#tcp_nopush on;

#keepalive_timeout 0;

keepalive_timeout 65;

#gzip on;

server {

listen 80;

server_name localhost;

#charset koi8-r;

#access_log logs/host.access.log main;

location / {

root html;

index index.html index.htm;

}

#error_page 404 /404.html;

# redirect server error pages to the static page /50x.html

error_page 500 502 503 504 /50x.html;

location = /50x.html {

root html;

}

# proxy the PHP scripts to Apache listening on 127.0.0.1:80

#location ~ \.php$ {

# proxy_pass http://127.0.0.1;

# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000

#location ~ \.php$ {

# root html;

# fastcgi_pass 127.0.0.1:9000;

# fastcgi_index index.php;

# fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;

# include fastcgi_params;

# deny access to .htaccess files, if Apache's document root

# concurs with nginx's one

#location ~ /\.ht {

# deny all;

}

# another virtual host using mix of IP-, name-, and port-based configuration

#server {

# listen 8000;

# listen somename:8080;

# server_name somename alias another.alias;

# location / {

# root html;

# index index.html index.htm;

# }

# HTTPS server

#server {

# listen 443 ssl;

# server_name localhost;

# ssl_certificate cert.pem;

# ssl_certificate_key cert.key;

# ssl_session_cache shared:SSL:1m;

# ssl_session_timeout 5m;

# ssl_ciphers HIGH:!aNULL:!MD5;

# ssl_prefer_server_ciphers on;

# location / {

# root html;

# index index.html index.htm;

# }

}

stream {

upstream bind-ms {

server 192.168.8.158:53;

server 192.168.8.157:53;

}

server {

listen 53 udp;

proxy_pass bind-ms;

proxy_timeout 120s;

error_log logs/proxy-bind-error.log error;

}

检测159主机配置语法

[root@op-159 openresty-1.25.3.1]# /usr/local/openresty/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/openresty/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/openresty/nginx/conf/nginx.conf test is successful

配置160主机配置文件

[root@op-160 openresty-1.25.3.1]# cat /usr/local/openresty/nginx/conf/nginx.conf

#user nobody;

worker_processes 1;

#error_log logs/error.log;

#error_log logs/error.log notice;

#error_log logs/error.log info;

#pid logs/nginx.pid;

events {

worker_connections 1024;

}

http {

include mime.types;

default_type application/octet-stream;

#log_format main '$remote_addr - $remote_user [$time_local] "$request" '

# '$status $body_bytes_sent "$http_referer" '

# '"$http_user_agent" "$http_x_forwarded_for"';

#access_log logs/access.log main;

sendfile on;

#tcp_nopush on;

#keepalive_timeout 0;

keepalive_timeout 65;

#gzip on;

server {

listen 80;

server_name localhost;

#charset koi8-r;

#access_log logs/host.access.log main;

location / {

root html;

index index.html index.htm;

}

#error_page 404 /404.html;

# redirect server error pages to the static page /50x.html

error_page 500 502 503 504 /50x.html;

location = /50x.html {

root html;

}

# proxy the PHP scripts to Apache listening on 127.0.0.1:80

#location ~ \.php$ {

# proxy_pass http://127.0.0.1;

# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000

#location ~ \.php$ {

# root html;

# fastcgi_pass 127.0.0.1:9000;

# fastcgi_index index.php;

# fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;

# include fastcgi_params;

# deny access to .htaccess files, if Apache's document root

# concurs with nginx's one

#location ~ /\.ht {

# deny all;

}

# another virtual host using mix of IP-, name-, and port-based configuration

#server {

# listen 8000;

# listen somename:8080;

# server_name somename alias another.alias;

# location / {

# root html;

# index index.html index.htm;

# }

# HTTPS server

#server {

# listen 443 ssl;

# server_name localhost;

# ssl_certificate cert.pem;

# ssl_certificate_key cert.key;

# ssl_session_cache shared:SSL:1m;

# ssl_session_timeout 5m;

# ssl_ciphers HIGH:!aNULL:!MD5;

# ssl_prefer_server_ciphers on;

# location / {

# root html;

# index index.html index.htm;

# }

}

stream {

upstream bind-ms {

server 192.168.8.158:53;

server 192.168.8.157:53;

}

server {

listen 53 udp;

proxy_pass bind-ms;

proxy_timeout 120s;

error_log logs/proxy-bind-error.log error;

}

检测160主机配置语法

[root@op-160 openresty-1.25.3.1]# /usr/local/openresty/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/openresty/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/openresty/nginx/conf/nginx.conf test is successful

159和160主机配置

cat /etc/resolv.conf

# Generated by NetworkManager

nameserver 192.168.8.158

nameserver 192.168.8.157

将159和160的OpenRestry重启

/usr/local/openresty/nginx/sbin/nginx -s reload

159主机测试

160主机测试

配置完成

老芦IT

关注

20
点赞
踩
26

收藏

觉得还不错? 一键收藏
1
评论
配置Bind主从及OpenRestry反向代理Bing解析

/ 这里就是设定域名为ldp.com，角色为从（slave），同步的配置文件在当前路径下的slaves/ldp.com.zone。//这里就是设置本机为主服务器，从服务器指向157主机，解析记录是/var/named/ldp.com.zone这个文件。udp的53端口是提供域名解析服务的，tcp的53是提供bind服务的。// 这里就是配置设置的本机127和本机ip地址的53端口。//这里就是配置设置的本机127和本机ip地址的53端口。//设置允许本机和8网段的地址可以解析。159和160主机配置。
复制链接

扫一扫