DNS 服务架构之综合实战
环境要求
需要8台主机
DNS客户端：172.31.0.10/16
本地DNS服务器（只缓存）：172.31.0.48/16
转发目标DNS服务器：172.31.0.38/16
根DNS服务器：172.31.0.18/16
org域DNS服务器：172.31.0.27/16
主DNS服务器：172.31.0.7/16
从DNS服务器：172.31.0.17/16
WEB服务器：171.31.0.37/16
前提准备
关闭SElinux
[root@localhost ~]# sed -ri 's/^(SELINUX=).*/\1disabled/' /etc/selinux/config
关闭防火墙
[root@localhost ~]# systemctl disable --now firewalld
时间同步
web服务器安装软件并配置和启动
# 172.31.0.37/16
[root@CentOS-7 ~]# yum install httpd -y
[root@CentOS-7 ~]# echo www.longxuan.vip > /var/www/html/index.html
[root@CentOS-7 ~]# systemctl start httpd
[root@CentOS-7 ~]# curl 172.31.0.37
www.longxuan.vip
主DNS安装软件
172.31.0.7/16
[root@localhost ~]# yum install -y bind bind-utils
主改配置文件
[root@centos8 ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
// allow-query { localhost; };
allow-transfer {172.31.0.17;};
主改配置文件
[root@localhost named]# vim /etc/named.rfc1912.zones
zone "longxuan.vip"{
type master;
file "longxuan.vip.zone";
};
主改配置文件
[root@localhost named]# vim longxuan.top.zone
$TTL 1D
@ IN SOA master admin.longxuan.vip. (
2021050104 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS master
NS slave1
master A 172.31.0.7
slave1 A 172.31.0.17
www A 172.31.0.37
重启服务
[root@localhost named]# systemctl start named #第一次启动服务，之后启动建议使用下面的命令
[root@localhost named]# rndc reload
从DNS服务器安装软件
# 172.31.0.17/16
[root@centos8 ~]# yum install -y bind bind-utils
从改配置文件
[root@centos8 ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
// allow-query { localhost; };
allow-transfer {none;};
从服务器配置
[root@centos8 ~]# vim /etc/named.rfc1912.zones
zone "longxuan.vip" {
type slave;
masters {172.31.0.7;};
file "slaves/longxuan.vip.slave";
};
从服务器重启服务
[root@centos8 ~]# rndc reload
server reload successful
检查从服务器看到同步成功
[root@centos8 ~]# ll /var/named/slaves/
org域服务器安装软件
# 172.31.0.27/16
[root@localhost ~]# yum install -y bind bind-utils
org域改配置文件
[root@localhost ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; };
org域改配置文件
[root@localhost ~]# vim /etc/named.rfc1912.zones
zone "org" {
type master;
file "org.zone";
};
org域改配置文件
[root@localhost ~]# vim /var/named/org.zone
$TTL 1D
@ IN SOA master admin.longxuan.vip. (
2021050100
1D
1H
1W
3D )
NS master
longxuan NS longxuanns1
longxuan NS longxuanns2
master A 172.31.0.27
longxuanns1 A 172.31.0.7
longxuanns2 A 172.31.0.17
授权
[root@localhost ~]# chgrp named /var/named/org.zone
启动
[root@localhost ~]# systemctl start named
根DNS服务器安装软件
# 172.31.0.18/16
[root@localhost ~]# yum install bind -y bind-utils
根DNS服务器改配置
[root@localhost ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
// allow-query { localhost; };
/*zone "." IN {
type hint;
file "named.ca";
};*/
zone "." IN {
type master;
file "root.zone";
};
根DNS服务器改配置
[root@localhost ~]# vim /var/named/root.zone
$TTL 1D
@ IN SOA master admin.longxuan.vip. (
2021050100
1D
1H
1W
3D )
NS master
org NS orgns
master A 172.31.0.18
orgns A 172.31.0.27
改所属组和授权640
[root@localhost ~]# chgrp named /var/named/root.zone
[root@localhost ~]# chmod 640 /var/named/root.zone
启动
[root@localhost ~]# systemctl start named #第一次启动，之后启动建议使用下面的命令
[root@localhost ~]# rndc reload
实现转发目标的DNS服务器
安装软件
# 172.31.0.38/16
[root@localhost ~]# yum install bind bind-utils -y
转发
[root@localhost ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; };
dnssec-enable no;
dnssec-validation no;
转发改配置
[root@localhost ~]# vim /var/named/named.ca
. 518400 IN NS a.root-servers.net.
a.root-servers.net. 3600000 IN A 172.31.0.18
启动
[root@localhost ~]# systemctl start named #第一次启动，之后启动建议使用下面的命令
[root@localhost ~]# rndc reload
本地缓存安装软件
# 172.31.0.48/16
[root@localhost ~]# yum install bind bind-utils -y
本地缓存改配置
[root@localhost ~]# vim /etc/named.conf
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; };
forward only;
forwarders {172.31.0.38;};
dnssec-enable no;
dnssec-validation no;
启动
[root@localhost ~]# systemctl start named #第一次启动，之后启动建议使用下面的命令
[root@localhost ~]# rndc reload
客户端测试
# 172.31.0.10/16
[root@centos6 ~]# cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 172.31.0.7
[root@centos6 ~]# dig www.longxuan.vip
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6 <<>> www.longxuan.vip
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13350
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;www.longxuan.vip. IN A
;; ANSWER SECTION:
www.longxuan.vip. 86400 IN A 172.31.0.37
;; AUTHORITY SECTION:
longxuan.vip. 86400 IN NS master.longxuan.vip.
longxuan.vip. 86400 IN NS slave.longxuan.vip.
;; ADDITIONAL SECTION:
master.longxuan.vip. 86400 IN A 172.31.0.7
slave.longxuan.vip. 86400 IN A 172.31.0.17
;; Query time: 4 msec
;; SERVER: 172.31.0.7#53(172.31.0.7)
;; WHEN: Mon May 1 13:41:57 2021
;; MSG SIZE rcvd: 123
[root@centos6 ~]# curl www.longxuan.vip
www.longxuan.vip
安装bind-utils报错
解决方法：
[root@localhost ~]# rpm -qa | grep bind
bind-export-libs-9.11.4-26.P2.el7_9.5.x86_64
bind-license-9.11.4-26.P2.el7_9.5.noarch
bind-libs-9.11.4-26.P2.el7_9.5.x86_64
bind-9.11.4-26.P2.el7_9.5.x86_64
bind-libs-lite-9.11.4-26.P2.el7_9.5.x86_64
[root@localhost ~]# yum remove bind-license-9.11.4 bind-libs-lite
# 重新安装即可
[root@localhost ~]# yum install bind-utils -y
