centos7 搭建DNS&泛解析配置
目标
1.搭建dns服务器
2.对test.com进行泛解析（本次dns服务器地址为：10.20.11.118；域名解析地址为：10.20.3.118）
开始
安装
- 安装bind：yum -y install bind bind-utils
- 启动服务： systemctl start named
- 设置开机启动： systemctl enable named
配置
vim /etc/named.conf
将：listen-on port 53 的值修改成 "any;"
allow-query 的值修改成 “any;”
为了确保修改的没有问题习惯性的验证下，命令如下：
named-checkconf /etc/named.conf
完整的配置文件如下：
// // named.conf // // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS // server as a caching only nameserver (as a localhost DNS resolver only). // // See /usr/share/doc/bind*/sample/ for example named configuration files. // // See the BIND Administrator's Reference Manual (ARM) for details about the // configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html options { listen-on port 53 { any; }; listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; allow-query { any; }; /* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */ recursion yes; dnssec-enable no; dnssec-validation no; /* Path to ISC DLV key */ bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; };
接下来可以配置域名了，本次的目标是将test.com配置成泛解析指向10.20.3.11
域名配置方式有两种一种是通过name.conf引用指向单独的域名解析文件；另外一种是直接在named.conf里进行配置，本次只演示第二种
1.修改 /etc/named.conf文件
vim /etc/named.conf
2.添加正向解析和反向解析
注意：/var/named目录存放的是域名映射文件，如果通过引用单独文件解析，只需要填写文件名会直接映射到对应文件
zone "test.com" IN { type master; file "/var/named/test.com.zone"; }; zone "11.20.10.in-addr.arpa" IN { type master; file "/var/named/11.20.10.zone"; };
3.新增正向解析配置文件
touch /var/named/test.com.zone
具体配置内容如下：
$TTL 1D @ IN SOA www.test.com. root ( 0 ; serial 1D ; refresh 1H ; retry 1W ; expire 3H ) ; minimum @ IN NS test.com. @ IN A 10.20.3.118 *.test.com. IN A 10.20.3.118
4.验证配置文件是否有错误：
named-checkzone test.com /var/named/test.com.zone
5.重启dns
systemctl restart named
6.测试：
1.修改本地dns
vim /etc/resolv.conf
2.添加内容至首行：
nameserver 10.20.11.118
3.直接ping测试，结果如下，如果是window将网络的首选dns设置成dns服务器即可
[root@localhost ~]# ping abc.test.com PING abc.test.com (10.20.3.118) 56(84) bytes of data. 64 bytes from 10.20.3.118 (10.20.3.118): icmp_seq=1 ttl=63 time=0.360 ms 64 bytes from 10.20.3.118 (10.20.3.118): icmp_seq=2 ttl=63 time=0.392 ms
至此正向解析已经完毕，注意这里一定要把防火墙放行或者关闭，否则外部无法连接到dns服务器，反向解析也类似这里就不一步一步来了，直接贴配置文件了
$TTL 1D @ IN SOA www.test.com. root ( 0 ; serial 1D ; refresh 1H ; retry 1W ; expire 3H ) ; minimum @ IN NS test.com. 118 IN PTR test.com.
测试
