• DNS（二）

    实现 Internet DNS 架构

    架构图

    实验环境

    关闭SELinux、Firewalld。时间保持一致

    主机名IP角色
    client192.168.28.146DNS客户端，DNS地址为192.168.28.145
    localdns192.168.28.145本地DNS服务器（只缓存）
    forward192.168.28.144转发目标DNS服务器
    rootdns192.168.28.141根DNS服务器
    comdns192.168.28.143com域DNS服务器
    master192.168.28.158wenzi.com域的主DNS服务器
    slave192.168.28.156wenzi.com域的从DNS服务器
    web192.168.28.159www.wenzi.com的web服务器

    一、配置设备网络

    将DNS客户端的dns指向本地DNS服务器（只缓存）

    1. [root@client ~]# nmcli con mod "System ens33" ipv4.address 192.168.28.146/24 ipv4.method manual ipv4.gateway 192.168.28.2 ipv4.dns 192.168.28.145
    2. [root@client ~]# nmcli con reload
    3. [root@client ~]# nmcli con up "System ens33"
    4. Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/4)
    5. [root@client ~]# cat /etc/resolv.conf
    6. # Generated by NetworkManager
    7. nameserver 192.168.28.145

    二、实现web服务

    [root@web ~]# yum -y install httpd && systemctl enable --now httpd && echo 'This is www.wenzi.com' > /var/www/html/index.html

    三、实现wenzi.com域的主DNS服务器

    修改配置文件

    1. [root@master ~]# vim /etc/named.conf
    2. options {
    3.         listen-on port 53 { 127.0.0.1; localhost; };    监听端口范围
    4. ...
    5.         allow-query     { localhost; 192.168.28.0/24; };    允许查询范围
    6.         allow-transfer  { 192.168.28.156; };    允许区域传输范围，即从DNS
    7. ...

    定义 wenzi.com 区域

    1. [root@master ~]# vim /etc/named.rfc1912.zones
    2. zone "wenzi.com" IN {
    3.         type master;
    4.         file "wenzi.com.zone";
    5. };
    6. ...

    编译wenzi.com.zone文件

    1. [root@master ~]# cd /var/named/
    2. [root@master named]# ll
    3. total 16
    4. drwxrwx--- 2 named named   23 Oct 17 21:43 data
    5. drwxrwx--- 2 named named   60 Oct 17 21:52 dynamic
    6. -rw-r----- 1 root  named 2253 Aug 25  2021 named.ca
    7. -rw-r----- 1 root  named  152 Aug 25  2021 named.empty
    8. -rw-r----- 1 root  named  152 Aug 25  2021 named.localhost
    9. -rw-r----- 1 root  named  168 Aug 25  2021 named.loopback
    10. drwxrwx--- 2 named named    6 Aug 25  2021 slaves
    11. [root@master named]# cp -a named.localhost wenzi.com.zone
    12. [root@master named]# vim wenzi.com.zone
    13. $TTL 1D
    14. @       IN SOA  master admin.wenzi.com. (
    15.                                         0       ; serial
    16.                                         1D      ; refresh
    17.                                         1H      ; retry
    18.                                         1W      ; expire
    19.                                         3H )    ; minimum
    20.  
    21. @       IN NS   master.wenzi.com.
    22. @       IN NS   slave.wenzi.com.
    23.  
    24. master  IN A    192.168.28.158
    25. slave   IN A    192.168.28.156
    26. www     IN A    192.168.28.159

    检查语法，重启服务

    1. [root@master named]# named-checkconf
    2. [root@master named]# named-checkzone wenzi.com  wenzi.com.zone
    3. zone wenzi.com/IN: loaded serial 0
    4. OK
    5. [root@master named]# rndc reload
    6. server reload successful

    四、实现wenzi.com域的从DNS服务器

    修改配置

    1. [root@slave ~]# vim /etc/named.conf
    2. options {
    3.         listen-on port 53 { 127.0.0.1; localhost; };
    4. ...
    5.         allow-query     { localhost; 192.168.28.0/24; };
    6.         allow-transfer  { none; };    禁止其它设备进行区域传输
    7. ...

    定义区域

    1. [root@slave ~]# vim /etc/named.rfc1912.zones
    2. zone "wenzi.com" {
    3.         type slave;
    4.         masters { 192.168.28.158; };
    5.         file "slaves/wenzi.com.zone.slave";
    6. };
    7. ...

    校验语法，并重启服务，发现区域文件已同步

    1. [root@slave ~]# named-checkconf
    2. [root@slave ~]# rndc reload
    3. server reload successful
    4. [root@slave ~]# ll /var/named/slaves/
    5. total 4
    6. -rw-r--r-- 1 named named 310 Oct 17 22:31 wenzi.com.zone.slave

    五、实现com域的主DNS服务器

    修改配置

    1. [root@comdns ~]# vim /etc/named.conf
    2. options {
    3.         listen-on port 53 { 127.0.0.1;localhost; };
    4. ...
    5.         allow-query     { localhost; 192.168.28.0/24; };
    6. ...

    定义 com 区域

    1. [root@comdns ~]# vim /etc/named.rfc1912.zones
    2. zone "com" {
    3.         type master;
    4.         file "com.zone";
    5. };

    编写 com.zone 文件

    1. [root@comdns ~]# cd /var/named/
    2. [root@comdns named]# cp -a named.localhost  com.zone
    3. $TTL 1D
    4. @       IN SOA  master admin.wenzi.com.. (
    5.                                         0       ; serial
    6.                                         1D      ; refresh
    7.                                         1H      ; retry
    8.                                         1W      ; expire
    9.                                         3H )    ; minimum
    10.  
    11. @       IN NS   master
    12. wenzi   IN NS   dnservermaster    wenzi.com.的主DNS服务器
    13. wenzi   IN NS   dnserverslave     wenzi.com.的从DNS服务器
    14.  
    15. master  IN A    192.168.28.143
    16. dnservermaster  IN A    192.168.28.158    主DNS服务器映射地址
    17. dnserverslave   IN A    192.168.28.156    从DNS服务器映射地址

     校验语法，并重启服务

    1. [root@comdns named]# named-checkconf
    2. [root@comdns named]# named-checkzone com com.zone
    3. zone com/IN: loaded serial 0
    4. OK
    5. [root@comdns named]# rndc reload
    6. server reload successful

    六、实现根域的主DNS服务器

    修改配置

    1. [root@rootdns ~]# vim /etc/named.conf
    2. options {
    3.         listen-on port 53 { 127.0.0.1; localhost;  };
    4. ...
    5.         allow-query     { localhost; 192.168.28.0/24; };
    6. ...

    定义区域

    1. [root@rootdns ~]# vim /etc/named.rfc1912.zones
    2. zone "." IN {
    3.         type master;
    4.         file "root.zone";
    5. };

    编写区域文件

    1. [root@rootdns named]# cp -a named.localhost root.zone
    2. [root@rootdns named]# vim root.zone
    3. $TTL 1D
    4. @       IN SOA  master admin.wenzi.com. (
    5.                                         0       ; serial
    6.                                         1D      ; refresh
    7.                                         1H      ; retry
    8.                                         1W      ; expire
    9.                                         3H )    ; minimum
    10.  
    11.         IN NS   master
    12. com     IN NS   comdns
    13.  
    14. master  IN A    192.168.28.141
    15. comdns  IN A    192.168.28.143

    校验语法，重启服务

    1. [root@rootdns named]# named-checkconf
    2. [root@rootdns named]# named-checkzone . root.zone
    3. zone ./IN: loaded serial 0
    4. OK
    5. [root@rootdns named]# rndc reload
    6. server reload successful

    七、实现转发目标的DNS服务器

    修改配置

    1. [root@forward ~]# vim /etc/named.conf
    2. options {
    3.         listen-on port 53 { 127.0.0.1; localhost; };
    4. ...
    5.         allow-query     { localhost; 192.168.28.0/24; };
    6. ...

    修改bind软件自带的根DNS服务器，实现将请求转发给自建DNS根服务器，而不是直接去互联网查找

    1. [root@forward ~]# vim /var/named/named.ca
    2. ...
    3. ;; QUESTION SECTION:
    4. ;.                              IN      NS
    5.  
    6. ;; ANSWER SECTION:
    7. .                       518400  IN      NS      a.root-servers.net.
    8.  
    9. ;; ADDITIONAL SECTION:
    10. a.root-servers.net.     518400  IN      A       192.168.28.141
    11. ...

    校验语法，重启服务

    1. [root@forward ~]# named-checkconf
    2. [root@forward ~]# rndc reload
    3. server reload successful

    八、实现本地只缓存DNS服务器

    修改配置

    1. options {
    2.         listen-on port 53 { 127.0.0.1; localhost; };
    3. ...
    4.         allow-query     { localhost; 192.168.28.0/24; };
    5.         forward only;
    6.         forwarders  { 192.168.28.144; };
    7. ...
    8.         recursion yes;    启动dns递归查询
    9.         dnssec-enable no;    不启用DNS安全拓展，通常关闭
    10.         dnssec-validation no;    不验证dnssec数据有效性，通常关闭
    11. ...

     检查语法，重启服务

    1. [root@localdns ~]# named-checkconf
    2. [root@localdns ~]# rndc reload
    3. server reload successful

    九、客户端测试

    1. [root@client ~]# host www.wenzi.com
    2. www.wenzi.com has address 192.168.28.159
    3.  
    4.  
    5. [root@client ~]# dig www.wenzi.com
    6.  
    7. ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.14 <<>> www.wenzi.com
    8. ;; global options: +cmd
    9. ;; Got answer:
    10. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15173
    11. ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
    13. ;; OPT PSEUDOSECTION:
    14. ; EDNS: version: 0, flags:; udp: 4096
    15. ;; QUESTION SECTION:
    16. ;www.wenzi.com.                 IN      A
    18. ;; ANSWER SECTION:
    19. www.wenzi.com.          85706   IN      A       192.168.28.159
    21. ;; AUTHORITY SECTION:
    22. wenzi.com.              85706   IN      NS      dnservermaster.com.
    23. wenzi.com.              85706   IN      NS      dnserverslave.com.
    25. ;; ADDITIONAL SECTION:
    26. dnserverslave.com.      85706   IN      A       192.168.28.156
    27. dnservermaster.com.     85706   IN      A       192.168.28.158
    29. ;; Query time: 0 msec
    30. ;; SERVER: 192.168.28.145#53(192.168.28.145)
    31. ;; WHEN: Tue Oct 17 23:48:33 CST 2023
    32. ;; MSG SIZE  rcvd: 147
    36. [root@client ~]# curl www.wenzi.com
    37. This is www.wenzi.com
  • 相关阅读:
    elasticsearch使用脚本 滚动关闭索引，更新index setting
    Android事件分发机制
    Linux基础指令（三）
    基于SSM的大学生创新创业平台竞赛管理子系统设计与实现
    React 高频面试题1（答案和题目都是根据讯飞星火写的）
    Android 录音没有声音，设置AudioSource.VOICE_CALL直接MediaRecorder.start异常等系列问题
    LQ0001 方程整数解【枚举】
    开发盲盒应该具有哪些特点
    金蝶云星空签出元数据提示“数据中心业务对象版本高于应用版本”
    【STM32】SDIO—SD 卡读写01
  • 原文地址：https://blog.csdn.net/qq_40875048/article/details/133850494