Centos的DNS正反向解析

DNS服务

安装

yum -y install bind*

配置

named.conf

备份 : cp /etc/named.conf /etc/name.conf.bak

# cat /etc/named.conf

options {
	listen-on port 53 { any; };
	listen-on-v6 port 53 { ::1; };
	directory 	"/var/named";
	dump-file 	"/var/named/data/cache_dump.db";
	statistics-file "/var/named/data/named_stats.txt";
	memstatistics-file "/var/named/data/named_mem_stats.txt";
	allow-query     { any; };

	/* 
	 - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
	 - If you are building a RECURSIVE (caching) DNS server, you need to enable 
	   recursion. 
	 - If your recursive DNS server has a public IP address, you MUST enable access 
	   control to limit queries to your legitimate users. Failing to do so will
	   cause your server to become part of large scale DNS amplification 
	   attacks. Implementing BCP38 within your network would greatly
	   reduce such attack surface 
	*/
	recursion yes;

	dnssec-enable yes;
	dnssec-validation yes;

	/* Path to ISC DLV key */
	bindkeys-file "/etc/named.iscdlv.key";

	managed-keys-directory "/var/named/dynamic";

	pid-file "/run/named/named.pid";
	session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
	type hint;
	file "named.ca";
};

zone "test.com" IN {
	type master;
	file "test.com.zones";
	allow-transfer { 192.168.0.1; };
	allow-update { none; };
};

zone "168.192.in-addr.arpa" IN {
        type master;
        file "192.168.arpa";
	allow-transfer { 192.168.0.1; };
	allow-update { none; };
};

编辑正向代理配置test.com

修改在named.conf中指定的配置文件test.com

路径为/var/named/test.com

cat /var/named/test.com.zones
$TTL 86400
@       IN SOA  test.com. admin.test.com. (
					0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
@       IN    NS    ns1.test.com.
ns1 	IN    A	 192.168.0.1
www     IN    A  192.168.0.1
mail    IN    A  192.168.0.1   
dns-server    IN    A  192.168.0.1
harbor    IN    A  192.168.0.1
harbor197    IN    A  192.168.0.1
kafka01  IN   A 192.168.0.20 
kafka02  IN   A 192.168.0.202
kafka03  IN   A 192.168.0.233
broker1.kafka  IN   A 192.168.0.20
broker2.kafka  IN   A 192.168.0.202
broker3.kafka  IN   A 192.168.0.233
gitlab  IN    A 192.168.0.29

编辑反向代理配置192.168.arpa

cat 192.168.arpa 
$TTL 86400
@       IN SOA  test.com. admin.test.com. (
					0      ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
@         IN      NS      ns1.com.
1.0       IN      PTR    www.test.com. 
1.0       IN      PTR    mail.test.com.
1.0       IN      PTR    dns-server.test.com.   
20.0      IN      PTR    kafka01.test.com.   
202.0     IN      PTR    kafka02.test.com.   
233.0     IN      PTR    kafka03.test.com.   
29.0      IN      PTR    gitlab.test.com.
84.0      IN      PTR    nexus.test.com.
105.1	  IN	  PTR    redis01.test.com.
111.1     IN      PTR    redis02.test.com.
124.1     IN      PTR    redis03.test.com.

/etc/resolv.conf

所有新加入的服务器都需要在此文件中按此格式添加dns服务器地址,

# vim /etc/resolv.conf
nameserver 192.168.0.1

启动

systemctl start named
systemctl enable named

验证

# 正向验证
# nslookup nexus.test.com
Server:		192.168.0.1
Address:	192.168.0.1#53

Name:	nexus.test.com
Address: 192.168.0.84

#反向验证
# nslookup 192.168.0.84
Server:		192.168.0.1
Address:	192.168.0.1#53

84.0.168.192.in-addr.arpa	name = nexus.test.com.