规划
主节点Master：10.0.0.5
从节点Slave：10.0.0.6
转发forward：10.0.0.182
测试机：10.0.0.160
安装&启动
[root@centos8 ~]#cat /etc/redhat-release
CentOS Linux release 8.4.2105
[root@centos8 ~]#yum install -y bind
[root@centos8 ~]#systemctl enable --now named
配置
Server基础配置
[root@centos8 ~]#vim /etc/named.conf
options {
listen-on port 53 { localhost; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query { any; };
不关闭的服务同时，重新加载服务
[root@centos8 ~]#rndc reload
server reload successful
清除缓存
rndc flush
Client客户端配置
vim /etc/sysconfig/network-scripts/ifcfg-
DNS1=10.0.0.5
nmcli con reload
nmcli con up enxxx
测试
[root@centos7 ~]#yum install -y bind-utils
[root@centos7 ~]#dig www.magedu.org
区域数据库Zone
主从
从节点配置
[root@centos8 ~]# vim /etc/named.rfc1912.zones
zone "magedu.org" {
type slave;
masters {10.0.0.5;};
file "slaves/magedu.org.slave";
};
主节点配置
告知主节点还有其他slave
[root@centos8 named]#vim /var/named/magedu.org.zone
$TTL 1D
@ IN SOA master admin.magedu.org. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS master
NS slave1
slave1 A 10.0.0.6
master A 10.0.0.5
www A 10.0.0.16
AAAA ::1
实现主从节点立即同步
[root@centos8 named]#vim /var/named/magedu.org.zone
$TTL 1D
@ IN SOA master admin.magedu.org. (
1 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS master
NS slave1
slave1 A 10.0.0.6
master A 10.0.0.5
www A 10.0.0.16
AAAA ::1
主节点reload
主：
[root@centos8 named]#rndc reload
server reload successful
从节点验证是否立即同步
[root@centos8 ~]# ll /var/named/slaves/magedu.org.slave
-rw-r--r-- 1 named named 309 Sep 4 13:40 /var/named/slaves/magedu.org.slave
[root@centos8 ~]# ll /var/named/slaves/magedu.org.slave
-rw-r--r-- 1 named named 375 Sep 4 14:21 /var/named/slaves/magedu.org.slave
客户机测试
[root@centos7 ~]#dig www.magedu.org
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.7 <<>> www.magedu.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61324
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.magedu.org. IN A
;; ANSWER SECTION:
www.magedu.org. 86400 IN A 10.0.0.16
;; AUTHORITY SECTION:
magedu.org. 86400 IN NS slave1.magedu.org.
magedu.org. 86400 IN NS master.magedu.org.
;; ADDITIONAL SECTION:
master.magedu.org. 86400 IN A 10.0.0.5
slave1.magedu.org. 86400 IN A 10.0.0.6
;; Query time: 0 msec
;; SERVER: 10.0.0.5#53(10.0.0.5)
;; WHEN: 三 9月 08 15:06:21 CST 2021
;; MSG SIZE rcvd: 133
报错
[root@centos8 ~]#rndc reload
rndc: connect failed: 127.0.0.1#953: connection refused
原因：必须要先启动bind服务之后才能用rndc进行加载配置
验证：
[root@centos8 ~]#systemctl status named
● named.service - Berkeley Internet Name Domain (DNS)
Loaded: loaded (/usr/lib/systemd/system/named.service; enabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Sat 2021-09-04 13:43:42 CST; 33min ago
Process: 2148 ExecStop=/bin/sh -c /usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID (code=>
Process: 1809 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS (code=exited, status=0/SUCCESS)
Process: 1806 ExecStartPre=/bin/bash -c if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named->
Main PID: 1811 (code=exited, status=0/SUCCESS)
Sep 04 13:43:42 centos8.magedu.org named[1811]: shutting down: flushing changes
Sep 04 13:43:42 centos8.magedu.org named[1811]: stopping command channel on 127.0.0.1#953
Sep 04 13:43:42 centos8.magedu.org named[1811]: stopping command channel on ::1#953
Sep 04 13:43:42 centos8.magedu.org named[1811]: no longer listening on 127.0.0.1#53
Sep 04 13:43:42 centos8.magedu.org named[1811]: no longer listening on 10.0.0.5#53
Sep 04 13:43:42 centos8.magedu.org named[1811]: no longer listening on ::1#53
Sep 04 13:43:42 centos8.magedu.org named[1811]: exiting
Sep 04 13:43:42 centos8.magedu.org sh[2148]: kill: not enough arguments
Sep 04 13:43:42 centos8.magedu.org systemd[1]: named.service: Control process exited, code=exited status=1
Sep 04 13:43:42 centos8.magedu.org systemd[1]: named.service: Failed with result 'exit-code'.
[root@centos8 ~]#systemctl start named
[root@centos8 ~]#rndc reload
server reload successful
主从节点之间加密
未配置加密之前测试
[root@centos7 ~]#dig -t axfr magedu.org
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.7 <<>> -t axfr magedu.org
;; global options: +cmd
magedu.org. 86400 IN SOA master.magedu.org. admin.magedu.org. 1 86400 3600 604800 10800
magedu.org. 86400 IN NS master.magedu.org.
magedu.org. 86400 IN NS slave1.magedu.org.
master.magedu.org. 86400 IN A 10.0.0.5
slave1.magedu.org. 86400 IN A 10.0.0.6
www.magedu.org. 86400 IN A 10.0.0.16
www.magedu.org. 86400 IN AAAA ::1
magedu.org. 86400 IN SOA master.magedu.org. admin.magedu.org. 1 86400 3600 604800 10800
;; Query time: 0 msec
;; SERVER: 10.0.0.5#53(10.0.0.5)
;; WHEN: 六 9月 04 15:08:10 CST 2021
;; XFR size: 8 records (messages 1, bytes 239)
配置主节点加密
[root@centos8 ~]#vim /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
listen-on port 53 { localhost; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query { any; };
allow-transfer {10.0.0.6;};
[root@centos8 ~]#rndc reload
server reload successful
配置从节点加密
[root@centos8 ~]#cat /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
// allow-query { localhost; };
allow-transfer {none;};
测试
[root@centos7 ~]#dig -t axfr magedu.org
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.7 <<>> -t axfr magedu.org
;; global options: +cmd
; Transfer failed.
指定从节点测试
命令说明：dig www.test.com @1.1.1.1 指定1.1.1.1dns服务器解析www.test.com
[root@centos7 ~]#dig -t axfr magedu.org @10.0.0.6
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.7 <<>> -t axfr magedu.org @10.0.0.6
;; global options: +cmd
; Transfer failed.
转发查询
only模式
[root@localhost ~]# vi /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; };
forward only;
forwarders {10.0.0.5;};
客户端测试
[root@centos7 ~]#dig www.magedu.org @10.0.0.182
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.7 <<>> www.magedu.org @10.0.0.182
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4833
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.magedu.org. IN A
;; ANSWER SECTION:
www.magedu.org. 86400 IN A 10.0.0.16
;; Query time: 1124 msec
;; SERVER: 10.0.0.182#53(10.0.0.182)
;; WHEN: 三 9月 08 14:53:15 CST 2021
;; MSG SIZE rcvd: 59
first模式
转发forward节点配置
[root@localhost ~]# vi /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; };
forward first;
forwarders {10.0.0.5;};
重新加载配置
[root@localhost ~]# rndc reload
server reload successful
删掉主节点的路由表，使其不能访问网络，测试转发节点是否去互联网解析地址
[root@centos8 ~]#ip route
default via 10.0.0.2 dev ens33 proto static metric 100
10.0.0.0/24 dev ens33 proto kernel scope link src 10.0.0.5 metric 100
[root@centos8 ~]#ip route del default via 10.0.0.2 dev ens33 proto static metric 100
[root@centos8 ~]#ping www.baidu.com -c4
connect: Network is unreachable
客户端测试
[root@centos7 ~]#dig www.magedu.com @10.0.0.182
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.7 <<>> www.magedu.com @10.0.0.182
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43892
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 19
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.magedu.com. IN A
;; ANSWER SECTION:
www.magedu.com. 600 IN A 140.143.156.192
;; AUTHORITY SECTION:
magedu.com. 172795 IN NS ns2.alidns.com.
magedu.com. 172795 IN NS ns1.alidns.com.
;; ADDITIONAL SECTION:
ns1.alidns.com. 172795 IN A 140.205.81.21
ns1.alidns.com. 172795 IN A 106.11.141.111
ns1.alidns.com. 172795 IN A 106.11.141.121
ns1.alidns.com. 172795 IN A 106.11.211.51
ns1.alidns.com. 172795 IN A 106.11.211.61
ns1.alidns.com. 172795 IN A 140.205.41.11
ns1.alidns.com. 172795 IN A 140.205.41.21
ns1.alidns.com. 172795 IN A 140.205.81.11
ns2.alidns.com. 172795 IN A 106.11.141.122
ns2.alidns.com. 172795 IN A 106.11.211.52
ns2.alidns.com. 172795 IN A 106.11.211.62
ns2.alidns.com. 172795 IN A 140.205.41.12
ns2.alidns.com. 172795 IN A 140.205.41.22
ns2.alidns.com. 172795 IN A 140.205.81.12
ns2.alidns.com. 172795 IN A 140.205.81.22
ns2.alidns.com. 172795 IN A 106.11.141.112
ns1.alidns.com. 172795 IN AAAA 2400:3200:2000:54::1
ns2.alidns.com. 172795 IN AAAA 2400:3200:2000:55::1
;; Query time: 1209 msec
;; SERVER: 10.0.0.182#53(10.0.0.182)
;; WHEN: 三 9月 08 15:13:20 CST 2021
;; MSG SIZE rcvd: 414
删掉转发节点的路由表和主节点的路由表，测试
[root@localhost ~]# vi /etc/named.conf
[root@localhost ~]# ip route
default via 10.0.0.2 dev ens33 proto static metric 100
10.0.0.0/24 dev ens33 proto kernel scope link src 10.0.0.182 metric 100
[root@localhost ~]# ip route del default via 10.0.0.2 dev ens33 proto static metric 100
#清空dns缓存
[root@localhost ~]# rndc flush
客户端测试返回结果
[root@centos7 ~]#dig www.magedu.com @10.0.0.182
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.7 <<>> www.magedu.com @10.0.0.182
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 38296
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.magedu.com. IN A
;; Query time: 4 msec
;; SERVER: 10.0.0.182#53(10.0.0.182)
;; WHEN: 三 9月 08 15:15:35 CST 2021
;; MSG SIZE rcvd: 43
结论：测试成功
智能DNS
客户端配置
添加临时IP模拟不同网段
[root@centos7 ~]#ip a a 100.0.0.160/24 dev eno16777728
[root@centos7 ~]#ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eno16777728: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:0c:29:ef:11:53 brd ff:ff:ff:ff:ff:ff
inet 10.0.0.160/24 brd 10.0.0.255 scope global noprefixroute eno16777728
valid_lft forever preferred_lft forever
inet 100.0.0.160/24 scope global eno16777728
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:feef:1153/64 scope link noprefixroute
valid_lft forever preferred_lft forever
主节点配置
网络配置 添加临时IP地址
[root@centos8 ~]#ip a a 100.0.0.5/24 dev ens33
[root@centos8 ~]#ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:f6:1b:96 brd ff:ff:ff:ff:ff:ff
inet 10.0.0.5/24 brd 10.0.0.255 scope global noprefixroute ens33
valid_lft forever preferred_lft forever
inet 100.0.0.5/24 scope global ens33
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fef6:1b96/64 scope link noprefixroute
valid_lft forever preferred_lft forever
配置文件，添加acl，设置对应的view
[root@centos8 named]#vim /etc/named.conf
acl beijingnet {
10.0.0.0/24;
};
acl shanghainet {
100.0.0.0/24;
};
options {
listen-on port 53 { localhost; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query { any; };
allow-transfer {10.0.0.6;};
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
include "/etc/crypto-policies/back-ends/bind.config";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
view beijingview {
match-clients { beijingnet; };
include "/etc/named.rfc1912.zones.bj";
};
view shanghaiview {
match-clients { shanghainet; };
include "/etc/named.rfc1912.zones.sh";
};
include "/etc/named.root.key";
修改对应的zone文件
注意这里拷贝的时候要连同文件属性一同拷贝，不然后面使用rndc启动时候会有permission denied
[root@centos8 ~]#cd /var/named
[root@centos8 named]#cp -p magedu.org.zone magedu.org.zone.bj
[root@centos8 named]#cp -p magedu.org.zone magedu.org.zone.sh
配置文件具体内容
[root@centos8 named]#cat /var/named/magedu.org.zone.bj
$TTL 1D
@ IN SOA master admin.magedu.org. (
3 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS master
NS slave1
shanghai NS shanghaidns
master A 10.0.0.5
slave1 A 10.0.0.6
shanghaidns A 10.0.0.7
www A 10.0.0.16
AAAA ::1
[root@centos8 named]#cat /var/named/magedu.org.zone.sh
$TTL 1D
@ IN SOA master admin.magedu.org. (
3 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS master
NS slave1
shanghai NS shanghaidns
master A 10.0.0.5
slave1 A 10.0.0.6
shanghaidns A 10.0.0.7
www A 100.0.0.16
AAAA ::1
重新加载配置文件
[root@centos8 named]#rndc reload
server reload successful
客户端测试
[root@centos7 ~]#dig www.magedu.org @10.0.0.5
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.7 <<>> www.magedu.org @10.0.0.5
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59960
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.magedu.org. IN A
;; ANSWER SECTION:
www.magedu.org. 86400 IN A 10.0.0.16
;; AUTHORITY SECTION:
magedu.org. 86400 IN NS master.magedu.org.
magedu.org. 86400 IN NS slave1.magedu.org.
;; ADDITIONAL SECTION:
master.magedu.org. 86400 IN A 10.0.0.5
slave1.magedu.org. 86400 IN A 10.0.0.6
;; Query time: 4 msec
;; SERVER: 10.0.0.5#53(10.0.0.5)
;; WHEN: 三 9月 08 20:01:23 CST 2021
;; MSG SIZE rcvd: 133
您在 /var/spool/mail/root 中有新邮件
[root@centos7 ~]#dig www.magedu.org @100.0.0.5
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.7 <<>> www.magedu.org @100.0.0.5
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57063
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.magedu.org. IN A
;; ANSWER SECTION:
www.magedu.org. 86400 IN A 100.0.0.16
;; AUTHORITY SECTION:
magedu.org. 86400 IN NS slave1.magedu.org.
magedu.org. 86400 IN NS master.magedu.org.
;; ADDITIONAL SECTION:
master.magedu.org. 86400 IN A 10.0.0.5
slave1.magedu.org. 86400 IN A 10.0.0.6
;; Query time: 1 msec
;; SERVER: 100.0.0.5#53(100.0.0.5)
;; WHEN: 三 9月 08 20:01:36 CST 2021
;; MSG SIZE rcvd: 133
Q
Q：解释一下DNS服务的TCP端口53和UDP端口53
A：TCP的53负责查询和区域传输；UDP的53负责区域传输；
若关掉UDP的53端口，则主从节点之间的数据不能同步。
一些常见DNS地址
阿里DNS
223.5.5.5
223.6.6.6
南京信风网络科技有限公司DNS
114.114.114.119
1380
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
