一、正向域名test.com解析
- 安装DNS服务的软件包
yum install bind bind-utils
- 修改配置文件
# 修改下面两处地方
vim /etc/named.conf
listen-on port 53 { localhost; }; # 这里设置监听哪些主机的哪个端口，localhost表示本机的所有IP地址
allow-query { any; }; # 这里设置哪些主机能够请求查询，any表示任何主机
# 添加区域
vim /etc/named.rfc1912.zones
zone "test.com" IN {
type master;
file "test.com.zone";
};
- 创建相应的资源记录数据库文件
vim /var/named/test.com.zone
$TTL 1D
@ IN SOA ns1.test.com. admin.test.com. ( 1000 1D 1H 1W 3H )
NS ns1.test.com.
ns1 A 192.168.30.7
web A 192.168.20.45
www IN CNAME web
# 修改文件的权限，所属主为named 访问权限为640
ll test.com.zone
-rw-r----- 1 root named 176 Apr 19 14:52 test.com.zone
- 区域解析库文件的组成
它是由许多不同类型的RR（资源记录）组成，RR定义格式如下：
name [TTL] IN rr_type value
rr_type的值：
- SOA
- A
- AAAA
- PTR
- NS
- CNAME
- MX
TTL可从全局继承
Examples：
→SOA：Start Of Authority，起始授权记录；一个区域解析库有且仅能有一个SOA记录，必须位于解析库的第一条记录
magedu.com. 86400 IN SOA ns.magedu.com. nsadmin.magedu.com.
(
2015042201 ;序列号
2H ;刷新时间
10M ;重试时间
1W ;过期时间
1D ;否定答案的TTL值
)
→NS：Name Server，专用于标明当前区域的DNS服务器
magedu.com. IN NS ns1.magedu.com.
→A：internet Address，作用，FQDN --> IP
www.magedu.com. IN A 1.1.1.1
www.magedu.com. IN A 2.2.2.2
→MX：Mail eXchanger，邮件交换器
magedu.com. IN MX 10 mx1.magedu.com.
→PTR：PoinTeR。有特定格式，把IP地址反过来写；有特定后缀：in-addr.arpa.
4.3.2.1.in-addr.arpa. IN PTR www.magedu.com.
→CNAME：Canonical Name，别名记录
www.magedu.com. IN CNAME websrv.magedu.com.
- 启动服务并测试
# 检查配置文件是否有问题
named-checkconf
# 启动服务
systemctl start named
# 查看服务日志
journalctl -u named
# 使用 dig 命令测试
dig www.test.com @192.168.30.7
; <<>> DiG 9.9.4-RedHat-9.9.4-72.el7 <<>> www.test.com @192.168.30.7
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29355
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.test.com. IN A
;; ANSWER SECTION:
www.test.com. 86400 IN CNAME web.test.com.
web.test.com. 86400 IN A 192.168.20.45
;; AUTHORITY SECTION:
test.com. 86400 IN NS ns1.test.com.
;; ADDITIONAL SECTION:
ns1.test.com. 86400 IN A 192.168.30.7
;; Query time: 2 msec
;; SERVER: 192.168.30.7#53(192.168.30.7)
;; WHEN: Fri Apr 19 15:15:29 CST 2019
;; MSG SIZE rcvd: 109
二、反向解析 192.168.20.0
- 接上假定已经安装好DNS服务
- 添加反向解析区域配置
vim /etc/named.rfc1912.zones
zone "20.168.192.in-addr.arpa" IN {
type master;
file "192.168.20.zone";
};
- 创建反向解析数据库文件
vim /var/named/192.168.20.zone
$TTL 1D
@ IN SOA ns1.test.com. admin.test.com. (1000 1D 3H 1W 3H)
NS ns1.test.com.
ns1 A 192.168.30.7
45 IN PTR ns1.test.com.
- 修改添加的解析库文件的属主和访问权限
chgrp named 192.168.20.zone
chmod 640 192.168.20.zone
# 确认修改
ll 192.168.20.zone
-rw-r----- 1 root named 156 Apr 20 08:28 192.168.20.zone
- 检查语法错误，并重启服务进行测试
named-checkconf
systemctl restart named
dig -x 192.168.20.45 @192.168.30.7
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6 <<>> -x 192.168.20.45 @192.168.30.7
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50479
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;45.20.168.192.in-addr.arpa. IN PTR
;; ANSWER SECTION:
45.20.168.192.in-addr.arpa. 86400 IN PTR www.test.com.
;; AUTHORITY SECTION:
20.168.192.in-addr.arpa. 86400 IN NS ns1.test.com.
;; ADDITIONAL SECTION:
ns1.test.com. 86400 IN A 192.168.30.7
;; Query time: 27 msec
;; SERVER: 192.168.30.7#53(192.168.30.7)
;; WHEN: Fri Apr 12 19:06:51 2019
;; MSG SIZE rcvd: 104
三、主从DNS
- 主服务器( 192.168.30.7 )设置
# 设置哪些从服务器能同步主服务器的解析数据库
vim /etc/named.rfc1912.zones
zone "test.com" IN {
type master;
file "test.com.zone";
allow-transfer { 192.168.30.101; }; # 添加这行，控制哪些主机能够拉取服务器的数据。没有这行的话，默认是任何主机都可以拉取。
};
- 主服务器的解析库文件中添加从服务器的NS记录
vim /var/named/test.com.zone
$TTL 1D
@ IN SOA ns1.test.com. admin.test.com. ( 1000 1D 1H 1W 3H )
NS ns1.test.com.
NS slave.test.com. # 新增
ns1 A 192.168.30.7
slave A 192.168.30.101 #新增
web A 192.168.20.45
www IN CNAME web
- 从服务器( 192.168.30.101 )上安装和配置DNS服务
yum -y install bind bind-utils
# 修改下面两处地方
vim /etc/named.conf
listen-on port 53 { localhost; }; # 这里设置监听哪些主机的哪个端口，localhost表示本机的所有IP地址
allow-query { any; }; # 这里设置哪些主机能够请求查询，any表示任何主机
# 添加区域
vim /etc/named.rfc1912.zones
zone "test.com" IN {
type slave;
file "slaves/test.com.zone";
masters { 192.168.30.7; };
allow-transfer { none; }; # 为了安全
};
- 重启主从服务器的服务，并测试
# 查看解析库文件是否同步
ll /var/named/slaves/
total 4
-rw-r--r-- 1 named named 338 Apr 20 10:12 test.com.zone
dig www.test.com @192.168.30.101
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6 <<>> www.test.com @192.168.30.101
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63340
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;www.test.com. IN A
;; ANSWER SECTION:
www.test.com. 86400 IN CNAME web.test.com.
web.test.com. 86400 IN A 192.168.20.45
;; AUTHORITY SECTION:
test.com. 86400 IN NS slave.test.com.
test.com. 86400 IN NS ns1.test.com.
;; ADDITIONAL SECTION:
ns1.test.com. 86400 IN A 192.168.30.7
slave.test.com. 86400 IN A 192.168.30.101
;; Query time: 0 msec
;; SERVER: 192.168.30.101#53(192.168.30.101)
;; WHEN: Fri Apr 12 19:57:06 2019
;; MSG SIZE rcvd: 134
四、子域实现委派给另一台主机
- 上层DNS服务器( 192.168.30.7 )上配置子域对应的NS记录
# 配置 named.conf 安全选项为no
vim /etc/named.conf
dnssec-enable no;
dnssec-validation no;
# 区域文件中添加一条 NS 记录和 A 记录
vim /var/named/test.com.zone
$TTL 1D
@ IN SOA ns1.test.com. admin.test.com. ( 1000 1D 1H 1W 3H )
NS ns1.test.com.
NS slave.test.com.
tt.test.com. IN NS ns2.tt.test.com. #新增
ns1 A 192.168.30.7
ns2.tt.test.com. IN A 192.168.30.110 #新增
slave A 192.168.30.101
web A 192.168.20.45
www IN CNAME web
- 下层DNS服务器（192.168.30.110 ）上对子域配置解析服务
yum -y install bind bind-utils
# 注释那两行配置
vim /etc/named.conf
...
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
// allow-query { localhost; };
...
# 添加子域区域
vim /etc/named.rfc1912.zones
zone "tt.test.com" IN {
type master;
file "tt.test.com.zone";
};
# 创建区域文件，并修改权限
vim /var/named/tt.test.com.zone
$TTL 1D
@ IN SOA ns1 admin.tt.test.com. ( 2000 1D 3H 1W 3H )
NS ns1
ns1 IN A 192.168.30.110
web IN A 192.168.30.110
www IN CNAME web
# 修改权限
chgrp named /var/named/tt.test.com.zone
chmod 640 /var/named/tt.test.com.zone
- 启动子域服务，并进行测试
named-checkconf
systemctl start named
dig tt.test.com @192.168.30.7
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6 <<>> www.tt.test.com @192.168.30.7
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10982
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;www.tt.test.com. IN A
;; ANSWER SECTION:
www.tt.test.com. 86400 IN CNAME web.tt.test.com.
web.tt.test.com. 86400 IN A 192.168.30.110
;; AUTHORITY SECTION:
tt.test.com. 86400 IN NS ns1.tt.test.com.
;; ADDITIONAL SECTION:
ns1.tt.test.com. 86400 IN A 192.168.30.110
;; Query time: 14 msec
;; SERVER: 192.168.30.7#53(192.168.30.7)
;; WHEN: Fri Apr 12 21:56:48 2019
;; MSG SIZE rcvd: 101
五、DNS转发
转发功能就是我这里解析不了的，统统转发到指定的服务器上解析
- 配置 named.conf 开启转发功能
vim /etc/named.conf
Options {
...
forward only;
forwarders { 192.168.30.110;};
...
};
- 转发到的服务器上配置DNS服务
# 添加区域配置
vim /etc/named.rfc1912.zones
zone "test2.com" IN {
type master;
file "test2.com.zone";
};
#创建区域文件
vim /var/named/test2.com.zone
$TTL 1D
@ IN SOA ns1 admin.test2.com. ( 2000 1D 3H 1W 3H )
NS ns1
ns1 IN A 192.168.30.110
web IN A 192.168.30.110
www IN CNAME web
# 修改权限
ll /var/named/test2.com.zone
-rw-r----- 1 root named 166 Apr 20 16:15 /var/named/test2.com.zone
- 检查错误，并测试
named-checkconf
systemctl restart named
dig www.test2.com @192.168.30.7
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6 <<>> www.test2.com @192.168.30.7
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59721
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;www.test2.com. IN A
;; ANSWER SECTION:
www.test2.com. 85720 IN CNAME web.test2.com.
web.test2.com. 85720 IN A 192.168.30.110
;; AUTHORITY SECTION:
test2.com. 85720 IN NS ns1.test2.com.
;; ADDITIONAL SECTION:
ns1.test2.com. 85720 IN A 192.168.30.110
;; Query time: 2 msec
;; SERVER: 192.168.30.7#53(192.168.30.7)
;; WHEN: Fri Apr 12 22:36:13 2019
;; MSG SIZE rcvd: 99
六、智能DNS
这里主要的目的是：跨区域企业每一个区域都拥有单独的服务器，不同区域访问企业的服务器，DNS智能的指向对应区域的服务器。
- 配置 named.conf 文件
vim /etc/named.conf
# 必须在options 前面定义 acl 函数
acl bjnet {
192.168.30.0/24;
};
acl shnet {
192.168.31.0/24;
};
acl others {
any;
};
# 在文档的最后定义view ，注意view 外面不能再有 zone 的定义了，将 . 区域移到rfc1912.zones中
view bjview {
match-clients { bjnet; };
include "/etc/named.rfc1912.zones.bj";
};
view shview {
match-clients { shnet; };
include "/etc/named.rfc1912.zones.sh";
};
view othersview {
match-clients { others; };
include "/etc/named.rfc1912.zones";
};
- 创建对应的 named.rfc1912.zones 和 test.com.zone 文件
cp /etc/named.rfc1912.zones /etc/named.rfc1912.zones.bj -p
cp /etc/named.rfc1912.zones /etc/named.rfc1912.zones.sh -p
cp /var/named/test.com.zone /var/named/test.com.zone.bj -p
cp /var/named/test.com.zone /var/named/test.com.zone.sh -p
- 修改 named.rfc1912.zones* 的区域配置
vim /etc/named.rfc1912.zones
zone "test.com" IN {
type master;
file "test.com.zone";
allow-transfer { 192.168.30.101; };
};
vim /etc/named.rfc1912.zones.bj
zone "test.com" IN {
type master;
file "test.com.zone.bj";
allow-transfer { 192.168.30.101; };
};
vim /etc/named.rfc1912.zones.sh
zone "test.com" IN {
type master;
file "test.com.zone.sh";
allow-transfer { 192.168.30.101; };
};
- 修改 test.com.zone* 的配置
grep web test.com.zone*
test.com.zone:web A 192.168.20.1
test.com.zone:www IN CNAME web
test.com.zone.bj:web A 192.168.20.2
test.com.zone.bj:www IN CNAME web
test.com.zone.sh:web A 192.168.20.3
test.com.zone.sh:www IN CNAME web
- 重启服务，并测试
systemctl restart named
# 测试 bjnet
dig www.test.com @192.168.30.7
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6 <<>> www.test.com @192.168.30.7
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55938
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;www.test.com. IN A
;; ANSWER SECTION:
www.test.com. 86400 IN CNAME web.test.com.
web.test.com. 86400 IN A 192.168.20.2
;; AUTHORITY SECTION:
test.com. 86400 IN NS slave.test.com.
test.com. 86400 IN NS ns1.test.com.
;; ADDITIONAL SECTION:
ns1.test.com. 86400 IN A 192.168.30.7
slave.test.com. 86400 IN A 192.168.30.101
;; Query time: 2 msec
;; SERVER: 192.168.30.7#53(192.168.30.7)
;; WHEN: Sat Apr 20 18:57:04 2019
;; MSG SIZE rcvd: 134
# 测试 shnet
dig www.test.com @192.168.31.86
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6 <<>> www.test.com @192.168.31.86
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39815
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;www.test.com. IN A
;; ANSWER SECTION:
www.test.com. 86400 IN CNAME web.test.com.
web.test.com. 86400 IN A 192.168.20.3
;; AUTHORITY SECTION:
test.com. 86400 IN NS slave.test.com.
test.com. 86400 IN NS ns1.test.com.
;; ADDITIONAL SECTION:
ns1.test.com. 86400 IN A 192.168.30.7
slave.test.com. 86400 IN A 192.168.30.101
;; Query time: 4 msec
;; SERVER: 192.168.31.86#53(192.168.31.86)
;; WHEN: Sat Apr 20 18:57:34 2019
;; MSG SIZE rcvd: 134
# 测试 others
dig www.test.com @127.0.0.1
; <<>> DiG 9.9.4-RedHat-9.9.4-72.el7 <<>> www.test.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32396
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.test.com. IN A
;; ANSWER SECTION:
www.test.com. 86400 IN CNAME web.test.com.
web.test.com. 86400 IN A 192.168.20.1
;; AUTHORITY SECTION:
test.com. 86400 IN NS slave.test.com.
test.com. 86400 IN NS ns1.test.com.
;; ADDITIONAL SECTION:
ns1.test.com. 86400 IN A 192.168.30.7
slave.test.com. 86400 IN A 192.168.30.101
;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun Apr 21 11:10:02 CST 2019
;; MSG SIZE rcvd: 145
七、综合互联网的DNS架构
本次实验是模拟 www.test.com 这个网站的访问过程，搭建流程是：准备客户端–>搭建主从WEB服务器–>搭建电信小区的DNS服务器–>搭建 test.com 这个主从DNS服务器 --> 搭建 .com 服务器 -->搭建根服务器。共需要9台主机。
- 客户机准备 192.168.30.112
- 搭建主( 192.168.30.106 )从 ( 192.168.30.108 )WEB服务器
yum install httpd
echo welcom to master web server > /var/www/html/index.html
echo welcom to slave web server > /var/www/html/index.html
curl 192.168.30.108
curl 192.168.30.106
- 搭建 test.com 这个主( 192.168.30.7 ) 从 ( 192.168.30.101 )DNS服务器
# 设置主从
vim /etc/named.conf
listen-on port 53 { localhost; };
allow-query { any; };
allow-transfer { 192.168.30.101; }
vim /var/named/test.com.zone
$TTL 1D
@ IN SOA ns1.test.com. admin.test.com. ( 1002 1D 1H 1W 3H )
NS ns1.test.com.
NS slave.test.com.
ns1 A 192.168.30.7
slave A 192.168.30.101
web A 192.168.30.106
web A 192.168.30.108
www IN CNAME web
# 重启服务
rndc reload
# 在 30.112 客户机上测试
vim /etc/resolv.conf
nameserver 192.168.30.7
ping www.test.com
- 搭建 .com 服务器（ 192.168.30.6 ）
yum install bind
# 委派DNS服务器
vim /etc/named
// listen-on port 53 { 127.0.0.1; };
// allow-query { localhost; };
dnssec-enable no;
dnssec-validation no;
vim /etc/named.rfc1912.zones
zone "com" IN {
type master;
file "com.zone";
};
vim /var/named/com.zone
$TTL 1D
@ IN SOA dns1.com. admin.com. ( 1 1D 3H 3D 3H )
NS dns1
test NS dns2
test NS dns3
dns1 A 192.168.30.6
dns2 A 192.168.30.7
dns3 A 192.168.30.101
# 启动服务
service named start
# 在客户机上测试
vim /etc/resolv.conf
nameserver 192.168.30.6
ping www.test.com
- 搭建根服务器 （192.168.30.102）
yum install bind
# 委派DNS服务器,删除 named.conf 中原来的 zone “." 区域
vim /etc/named
// listen-on port 53 { 127.0.0.1; };
// allow-query { localhost; };
dnssec-enable no;
dnssec-validation no;
vim /etc/named.rfc1912.zones
zone "." IN {
type master;
file "root.zone";
};
vim /var/named/root.zone
$TTL 1D
@ IN SOA dns1. admin. ( 1 1D 3H 1W 3H )
NS dns1
com NS dns2
dns1 A 192.168.30.102
dns2 A 192.168.30.6
# 启动服务
service named start
# 在客户机上测试
vim /etc/resolv.conf
nameserver 192.168.30.102
ping www.test.com
- 搭建电信小区的DNS服务器（ 192.168.30.110）
yum install bind
# 委派DNS服务器
vim /etc/named
// listen-on port 53 { 127.0.0.1; };
// allow-query { localhost; };
dnssec-enable no;
dnssec-validation no;
# 修改根服务的位置,只保留这两条记录，其他删除
vim /var/named/named.ca
. 518400 IN NS a.root-servers.net.
a.root-servers.net. 3600000 IN A 192.168.30.102
# 启动服务
service named start
# 在客户机上测试
vim /etc/resolv.conf
nameserver 192.168.30.110
ping www.test.com
PING web.test.com (192.168.30.108) 56(84) bytes of data.
64 bytes from 192.168.30.108 (192.168.30.108): icmp_seq=1 ttl=64 time=0.508 ms
64 bytes from 192.168.30.108 (192.168.30.108): icmp_seq=2 ttl=64 time=1.09 ms
64 bytes from 192.168.30.108 (192.168.30.108): icmp_seq=3 ttl=64 time=0.793 ms
扫一扫
4414
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
