实现Internet 的DNS 服务架构
实验目的
环境要求
需要8台主机
DNS客户端:10.0.0.58/24
本地缓存DNS服务器:10.0.0.59/24
转发目标DNS服务器:10.0.0.60/24
根DNS服务器:10.0.0.61/24
子域DNS服务器:10.0.0.62/24
二级域主DNS服务器:10.0.0.63/24
二级域从DNS服务器:10.0.0.64/24
WEB服务器:10.0.0.65/24
前提准备
关闭SElinux
关闭防火墙
时间同步
DNS服务器清空DNS配置
配置WEB服务器
[root@WEB ~]# yum -y install httpd
[root@WEB ~]# echo www.george.org > /var/www/html/index.html
[root@WEB ~]# systemctl enable --now httpd
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
配置客户端
[root@client ~]# yum -y install bind-utils
[root@client ~]# vim /etc/resolv.conf
[root@client ~]# cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 10.0.0.59 #配置本地缓存DNS服务器
配置本地缓存DNS服务器
[root@local ~]# yum -y install bind ;systemctl enable --now named
[root@local ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; }; #//注释此行
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; }; #//注释此行
forward only; #转发模式设置only
forwarders {10.0.0.60;}; #代理指向转发目标的DNS服务器
dnssec-enable no; #关闭DNS安全
dnssec-validation no;
[root@local ~]# named-checkconf #检查配置文件语法
[root@local ~]# rndc reload #重启配置
server reload successful
配置转发目标的DNS服务器
[root@forward ~]# yum -y install bind ;systemctl enable --now named
[root@forward ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; }; #//注释此行
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; }; #//注释此行
[root@forward ~]# vim /var/named/named.ca
. 518400 IN NS a.root-servers.net.
a.root-servers.net. 518400 IN A 10.0.0.61 #把转发的目标指向根DNS服务器
[root@forward ~]# rndc reload #重启配置
server reload successful
配置根DNS服务器
[root@root ~]# yum -y install bind ;systemctl enable --now named
[root@root ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; }; #//注释此行
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; }; #//注释此行
zone "." IN {
type master;
file "root.zone";
};
[root@root ~]# cp -p /var/named/named.localhost /var/named/root.zone #按照原有文件格式属性配置
[root@root ~]# vim /var/named/root.zone
$TTL 1D
@ IN SOA master admin.george.org. (
1 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS master
org NS orgns
master A 10.0.0.61
orgns A 10.0.0.62 #指向子域DNS服务器
[root@root ~]# rndc reload #重启配置
server reload successful
配置子域DNS服务器
[root@org ~]# yum -y install bind ;systemctl enable --now named
[root@org ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; }; #//注释此行
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; }; #//注释此行
zone "org" { #加上这段
type master;
file "org.zone";
};
[root@org ~]# cp -p /var/named/named.localhost /var/named/org.zone #按照原有文件格式属性配置
[root@org ~]# vim /var/named/org.zone
$TTL 1D
@ IN SOA master admin.george.org. (
1 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS master
george NS georgens1
george NS georgens2
master A 10.0.0.62
georgens1 A 10.0.0.63 #指向主DNS服务器
georgens2 A 10.0.0.64 #指向从DNS服务器
[root@org ~]# rndc reload #重启配置
server reload successful
配置二级域主DNS服务器
[root@MASTER ~]# yum -y install bind ;systemctl enable --now named
[root@MASTER ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; };
allow-transfer { 10.0.0.64;}; #添加此行,只允许从服务器进行区域传输
[root@MASTER ~]# vim /etc/named.rfc1912.zones
zone "george.org" { #加上这段
type master;
file "george.org.zone";
};
[root@MASTER ~]# vim /var/named/george.org.zone
$TTL 1D
@ IN SOA master admin.george.org. (
1 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS master
NS slave
master A 10.0.0.63
slave A 10.0.0.64 #指向从NDS服务器
www A 10.0.0.65 #指向WEB服务器
[root@MASTER ~]# rndc reload #重启配置
server reload successful
配置二级域从DNS服务器
[root@SLAVE ~]# yum -y install bind ;systemctl enable --now named
[root@SLAVE ~]# vim /etc/named.conf
// listen-on port 53 { 127.0.0.1; }; #//注释此行
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; }; #//注释此行
allow-transfer { none;}; #添加此行,不允许其他主机进行区域传输
[root@SLAVE ~]# vim /etc/named.rfc1912.zones
zone "george.org" { #加上这段
type slave;
masters { 10.0.0.63;};
file "slaves/george.org.slave";
};
[root@SLAVE ~]# rndc reload #重启配置
server reload successful
[root@SLAVE slaves]# ll /var/named/slaves/george.org.slave #查看区域数据库文件是否生成
-rw-r--r-- 1 named named 319 Sep 14 23:19 /var/named/slaves/george.org.slave
客户机端测试
[root@client ~]# cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 10.0.0.59
[root@client ~]# dig www.george.org
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7 <<>> www.george.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29212
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.george.org. IN A
;; ANSWER SECTION:
www.george.org. 86178 IN A 10.0.0.65 #有应答回去就成功了
;; Query time: 1 msec
;; SERVER: 10.0.0.59#53(10.0.0.59)
;; WHEN: Tue Sep 15 08:49:23 CST 2020
;; MSG SIZE rcvd: 59
[root@client ~]# curl www.george.org
www.george.local