DNS，綜合案例：實現internet的DNS服務架構
阿新 • • 發佈：2020-09-15
搭建DNS實現internet dns 架構
環境要求
需要8臺主機
DNS客戶端：10.0.0.6/24
本地DNS伺服器（只快取）：10.0.0.8/24
轉發目標DNS伺服器：10.0.0.18/24
根DNS伺服器：10.0.0.28/24
org域DNS伺服器：10.0.0.38/24
magedu.org域主DNS伺服器：10.0.0.48/24
magedu.org域從DNS伺服器：10.0.0.58/24
www.magedu.org的WEB伺服器：10.0.0.68/24
前提準備
關閉selinux 關閉防火牆 時間同步
實現步驟
各種主機的網路配置
客戶端配置
#在客戶端配置DNS伺服器地址
vim /etc/sysconfig/network-scripts/ifcfg-ens33
DEVICE=eth0
BOOTPROTO=static
IPADDR=10.0.0.6
NETMASK=255.255.255.0
DNS1=10.0.0.8
ONBOOT=yes
service network restart
實現web服務
#在web伺服器10.0.0.68/24上實現
yum install httpd
echo www.magedu.org > /var/www/html/index.html
systemctl start httpd
實現magedu.org域的主dns伺服器
#在magedu.org域主DNS伺服器10.0.0.48/24上實現
yum install bind -y
vim /etc/named.conf
#註釋掉下面兩行
// listen-on port 53 { 127.0.0.1; };
// allow-query { localhost; };
#只允許從伺服器進行區域傳輸,新增內容
allow-transfer { 從伺服器IP;};
vim /etc/named.rfc1912.zones
#加上這段
zone "magedu.org" {
type master;
file "magedu.org.zone";
};
vim /var/named/magedu.org.zone
$TTL 1D
@ IN SOA master admin.magedu.org. (
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS master
NS slave
master A 10.0.0.48
slave A 10.0.0.58
www A 10.0.0.68
#yum -y install bind-utils
#named-checkconf
#named-checkzone magedu.org /var/named/magedu.org.zone
#chmod 640 /var/named/magedu.org.zone
#chgrp named /var/named/magedu.org.zone
#systemctl start named #第一次啟動服務
#rndc reload #不是第一次啟動服務
實現magedu.org域的從DNS伺服器配置
#在magedu.org域從DNS伺服器10.0.0.58/24上實現
yum install bind -y
vim /etc/named.conf
// listen-on port 53 { 127.0.0.1; };
// allow-query { localhost; };
#不允許其它主機進行區域傳輸，新增內容
allow-transfer { none;};
vim /etc/named.rfc1912.zones
zone "magedu.org" {
type slave;
masters { 主伺服器IP;}; file "slaves/magedu.org.slave";
};
#named-check #檢查語法
systemctl start named #第一次啟動服務
rndc reload #不是第一次啟動服務
ls /var/named/slaves/magedu.org.slave #檢視區域資料庫檔案是否生成
實現org域的主DNS伺服器
#在org域的主DNS伺服器10.0.0.38/24上實現
yum install bind -y
#vim /etc/named.conf
#註釋掉兩行
// listen-on port 53 { 127.0.0.1; };
// allow-query { localhost; };
#vim /etc/named.rfc1912.zones
#加上這段
zone "org" {
type master;
file "org.zone";
};
#vim /var/named/org.zone
$TTL 1D
@ IN SOA master admin.magedu.org. ( 1 1D 1H 1W 3D )
NS master
magedu NS mageduns1
magedu NS mageduns2
master A 10.0.0.38
mageduns1 A 10.0.0.48
mageduns2 A 10.0.0.58
#chmod 640 /var/named/org.zone
#chgrp named /var/named/org.zone
#systemctl start named #第一次啟動服務
#rndc reload #不是第一次啟動服務
實現根域的主DNS伺服器
#在根域的主DNS伺服器10.0.0.28/24上實現
yum install bind -y
#vim /etc/named.conf
#註釋掉兩行，第13行和第21行
// listen-on port 53 { 127.0.0.1; };
// allow-query { localhost; };
#將下面行改為：
zone "." IN {
type master;
file "root.zone";
};
#vim /var/named/root.zone
$TTL 1D
@ IN SOA master admin.magedu.org. ( 1 1D 1H 1W 3D )
NS master
org NS orgns
master A 10.0.0.28
orgns A 10.0.0.38
#安全加固
chgrp named /var/named/root.zone
chmod 640 /var/named/root.zone
systemctl start named #第一次啟動
rndc reload #不是第一次啟動
實現轉發目標的DNS伺服器
#在轉發目標的DNS伺服器10.0.0.18/24上實現
yum install bind -y
vim /etc/named.conf
#註釋掉兩行，第13行和第21行
// listen-on port 53 { 127.0.0.1; };
// allow-query { localhost; };
dnssec-enable no;
dnssec-validation no
vim /var/named/named.ca
. 518400 IN NS a.root-servers.net.
a.root-servers.net. 3600000 IN A 10.0.0.28
systemctl start named #第一次啟動
rndc reload #不是第一次啟動
實現本地快取DNS伺服器
#在轉發目標的DNS伺服器10.0.0.8/24上實現
yum install bind -y
vim /etc/named.conf
#註釋掉兩行，第13行和第21行
// listen-on port 53 { 127.0.0.1; };
// allow-query { localhost; };
#新增轉發伺服器地址
forward only;
forwarders { 10.0.0.18;};
#關閉安全加密
dnssec-enable no;
dnssec-validation no
systemctl start named #第一次啟動
rndc reload #不是第一次啟動
客戶端測試
#cat /etc/resolv.conf
nameserver 10.0.0.8
#dig www.magedu.org
; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> www.magedu.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40755
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.magedu.org. IN A
;; ANSWER SECTION:
www.magedu.org. 86181 IN A 10.0.0.68
;; AUTHORITY SECTION:
magedu.org. 86181 IN NS ns2.magedu.org.
magedu.org. 86181 IN NS ns1.magedu.org.
;; ADDITIONAL SECTION:
ns2.magedu.org. 86181 IN A 10.0.0.48
ns1.magedu.org. 86181 IN A 10.0.0.58
;; Query time: 1 msec
;; SERVER: 10.0.0.8#53(10.0.0.8)
;; WHEN: Fri May 10 17:28:39 CST 2019
;; MSG SIZE rcvd: 127 成功
#curl www.magedu.org
www.magedu.org
#客戶端診斷工具,檢視IP走向
#tcpdump -i eth0 udp port 53 -nn
10:40:48.116236 IP 10.0.0.6.40255 > 10.0.0.26.53: 30543+ A? www.magedu.org. (32)
10:40:48.116278 IP 10.0.0.6.40255 > 10.0.0.26.53: 2993+ AAAA? www.magedu.org. (32)
10:40:48.116635 IP 10.0.0.26.16061 > 10.0.0.17.53: 57114+% [1au] A? www.magedu.org. (43)
10:40:48.116712 IP 10.0.0.26.12121 > 10.0.0.17.53: 48589+% [1au] AAAA? www.magedu.org. (43)
10:40:48.118915 IP 10.0.0.17.43187 > 10.0.0.27.53: 52745% [1au] A? www.magedu.org. (43)
10:40:48.118930 IP 10.0.0.17.53131 > 10.0.0.27.53: 18699% [1au] AAAA? www.magedu.org. (43)
10:40:48.120486 IP 10.0.0.17.40652 > 10.0.0.27.53: 55943 [1au] NS? . (28)
10:40:48.121721 IP 10.0.0.27.53 > 10.0.0.17.43187: 52745 0/1/2 (78)
10:40:48.122582 IP 10.0.0.27.53 > 10.0.0.17.53131: 18699 0/1/2 (78)
10:40:48.123839 IP 10.0.0.27.53 > 10.0.0.17.40652: 55943* 1/0/2 NS master. (63)
10:40:48.130035 IP 10.0.0.17.51804 > 10.0.0.37.53: 38792% [1au] A? www.magedu.org. (43)
10:40:48.130074 IP 10.0.0.17.54721 > 10.0.0.37.53: 19424% [1au] AAAA? www.magedu.org. (43)
10:40:48.132568 IP 10.0.0.37.53 > 10.0.0.17.51804: 38792 0/2/3 (123)
10:40:48.132580 IP 10.0.0.37.53 > 10.0.0.17.54721: 19424 0/2/3 (123)
10:40:48.134568 IP 10.0.0.17.43536 > 10.0.0.28.53: 61837% [1au] A? www.magedu.org. (43)
10:40:48.134926 IP 10.0.0.28.53 > 10.0.0.17.43536: 61837* 1/0/1 A 10.0.0.38 (59)
10:40:48.135508 IP 10.0.0.17.33788 > 10.0.0.28.53: 21937% [1au] AAAA? www.magedu.org. (43)
10:40:48.135693 IP 10.0.0.28.53 > 10.0.0.17.33788: 21937* 0/1/1 (92)
10:40:48.137954 IP 10.0.0.17.53 > 10.0.0.26.16061: 57114 1/2/3 A 10.0.0.38 (139)
10:40:48.139019 IP 10.0.0.26.53 > 10.0.0.6.40255: 30543 1/2/2 A 10.0.0.38 (128)
10:40:48.139395 IP 10.0.0.17.53 > 10.0.0.26.12121: 48589 0/1/1 (92)
10:40:48.139631 IP 10.0.0.26.53 > 10.0.0.6.40255: 2993 0/1/0 (81)