DNS实战

最新推荐文章于 2022-08-19 12:44:26 发布

骑驴藐日月

最新推荐文章于 2022-08-19 12:44:26 发布

阅读量1.1k

点赞数

分类专栏： DHCP DNS

本文链接：https://blog.youkuaiyun.com/zzban1111/article/details/13509073

版权

DHCP 同时被 2 个专栏收录

3 篇文章

订阅专栏

DNS

2 篇文章

订阅专栏

示例：

一企业欲设计本公司的网络架构，基本要求如下：

1.网段：

设计部： 192.168.0.0/24 （默认网关：192.168.0.1 , IP段：192.168.0.20-192.168.0.100 192.168.0.120-192.168.0.250）

财务部： 192.168.1.0/24 （默认网关：192.168.1.1 , IP段：192.168.1.20-192.168.1.250）

2. 服务器及其功能

服务器1：主DNS/主DHCP （域名：dns.example.com IP： 192.168.0.10）

服务器2：辅DNS/中继DHCP（域名：dns1.example.com IP： 192.168.1.10）

3. 域名后缀：example.com

4. 内网将域名www.example.com和mail.example.com解析IP为：192.168.0.10

外网将域名www.example.com和mail.example.com解析IP为：202.103.0.10

5. 采用DDNS实现域名的动态解析

案例实施：

（1）在dns.example.com和dns1.example.com上安装DHCP服务和BIND服务

# aptitude install dhcp3-server dhcp3-relay

# aptitude install bind9 dnsutils

（2）开启两台服务器路由转发功能

a. 临时性修改：# /bin/echo "1" > /proc/sys/net/ipv4/ip_forward

b. 永久性修改：修改文件/etc/sysctl.conf中的net.ipv4.ip_forward=1

（3）修改dns.example.com上修改/etc/default/isc-dhcp-server（功能：用eth0端口侦听DHCP中继发送的DHCP请求）

INTERFACES="eth0"

（4）在dns.example.com上为DDNS创建密钥，并获取该密钥

# dnssec-keygen -a HMAC-MD5 -b 128 -n USER tiddyzhangdns

（5）在dns.example.com上为TSIG创建密钥，并获取密钥

# dnssec-keygen -a HMAC-MD5 -b 128 -n HOST rndc-key

（6）在dns.example.com上使用/usr/share/doc/dhcp*/dhcpd.conf.sample覆盖/etc/dhpc/dhcpd.conf，并修改其内容如下：

ddns-update-style interim;

ignore client-updates;

options domain-name "example.com";

key tiddyzhangdns {

algorithm hmac-md5;

secret mis236YgbtAvJQY4UdTvZg==;

}

zone example.com. {

primary 192.168.0.10;

key tiddyzhangdns;

}

zone 0.168.192.in-addr.arpa. {

primary 192.168.0.10;

key tiddyzhangdns;

}

zone 1.168.192.in-addr.arpa. {

primary 192.168.1.10;

key tiddyzhangdns;

}

share-network example {

subnet 192.168.0.0 netmask 255.255.255.0 {

option domain-name-servers 192.168.0.10, 192.168.1.10;

option routers 192.168.0.1;

option subnet-mask 255.255.255.0;

option time-offset +28800;

range 192.168.0.20 192.168.0.100;

range 192.168.0.120 192.168.0.250;

default-lease-time 21600;

max-lease-time 43200;

}

subnet 192.168.1.0 netmask 255.255.255.0 {

option domain-name-servers 192.168.1.10, 192.168.0.10;

option routers 192.168.1.1;

option subnet-mask 255.255.255.0;

option time-offset +28800;

range 192.168.1.20 192.168.1.250;

default-lease-time 21600;

max-lease-time 43200;

}

（7）修改dns.example.com上BIND的全局配置文件/etc/bind/named.conf.options

options {

listen-on port 53 { any; };

#202.103.24.68为ISP的DNS服务器

forwarders { 202.103.24.68; };

forward first;

};

key tiddyzhangtransfer {

algorithm hmac-md5;

secret 3JhG17t9oRtJ4mt5Ife0WQ==;

};

server 192.168.1.10 {

key { tiddyzhangtransfer; };

};

key tiddyzhangdns {

algorithm hmac-md5;

secret mis236YgbtAvJQY4UdTvZg==;

};

view example_LAN_resolver {

match-clients { 192.168.0.0/16; };

match-destinations { any; };

recursion yes;

include "/etc/bind/named_lan.zones";

};

view example_WAN_resolver {

match-clients { any; };

match-destinations { any; };

recursion yes;

include "/etc/bind/named_wan.zones";

};

（8）在dns.example.com上配置bind的主配置文件

a. 修改文件/etc/bind/named_lan.zones

zone "example.com" {

type master;

file "/etc/bind/example.com.lan.zero";

allow-update { key tiddyzhangdns; };

allow-transfer { key tiddyzhangtransfer; };

};

zone "0.168.192.in-addr.arpa" {

type master;

file "/etc/bind/0.168.192.local";

allow-update { key tiddyzhangdns; };

allow-transfer { key tiddyzhangtransfer; };

};

zone "1.168.192.in-addr.arpa" {

type master;

file "/etc/bind/1.168.192.in-addr.arpa";

allow-update { key tiddyzhangdns; };

allow-transfer { key tiddyzhangtransfer; };

};

b. 修改文件/etc/bind/named_wan.zones

zone "example.com" {

type master;

file "/etc/bind/example.com.wan.zero";

};

（9）在dns.example.com上配置BIND区域配置文件

a. 修改区域配置文件/etc/bind/example.com.lan.zero

$TTL 86400

@ IN SOA dns.example.com. root.example.com. ( 20131029 3H 15M 1W 1D)

IN NS dns.example.com.

IN MX 10 dns.example.com.

dns IN A 192.168.0.10

www IN CNAME dns.example.com.

mail IN CNAME dns.example.com.

b. 修改区域配置文件/etc/bind/example.com.wan.zero

$TTL 86400

@ IN SOA dns.example.com. root.example.com. ( 20131029 3H 15M 1W 1D)

IN NS dns.example.com.

IN MX 10 dns.example.com.

dns IN A 202.103.0.10

www IN CNAME dns.example.com.

mail IN CNAME dns.example.com.

c. 修改区域配置文件/etc/bind/0.168.192.local

$TTL 86400

@ IN SOA dns.example.com. root.example.com. ( 2013102902 3H 15M 1W 1D)

IN NS dns.example.com.

10 IN PTR dns.example.com.

d. 修改区域配置文件/etc/bind/1.168.192.local

$TTL 86400

@ IN SOA dns.example.com. root.example.com. ( 2013102902 3H 15M 1W 1D)

IN NS dns.example.com.

10 IN PTR dns1.example.com.

（10）在dns1.example.com修改/etc/default/isc-dhcp-relay文件，内容如下：

INTERFACES="eth0"

DHCPSERVERS="192.168.0.10"

（11）在dns1.example.com上配置BIND全局配置文件

options {

listen-on port 53 { any; };

....

allow-query { 192.168.0.0/16;};

};

key tiddyzhangtransfer {

algorithm hmac-md5;

secret 3JhG17t9oRtJ4mt5Ife0WQ==;

};

server 192.168.0.10 {

key { tiddyzhangtransfer};

};

view example_LAN_resolver {

match-clients { 192.168.0.0/16; };

match-destinations { any; };

recursion yes;

include "/etc/bind/named_lan.zones";

};

（12）修改dns1.example.com中BIND主配置文件/etc/bind/named_lan.zones

zone "example.com" {

type slave;

masters { 192.168.0.10; };

file "/etc/bind/example.com.zero";

};

zone "0.168.192.in-addr.arpa" {

type slave;

masters { 192.168.0.10; };

file "/etc/bind/0.168.192.local";

};

zone "1.168.192.in-addr.arpa" {

type slave;

masters { 192.168.0.10; };

file "/etc/bind/1.168.192.local";

};

到此，DHCP和DNS服务器的配置完成。