? 3)修改配置文件，修改?listen-on port 53 { 127.0.0.1; };为listen-on port 53 { localhost; }; 和修改allow-query? ? ?{ localhost; }; 为allow-query? ? ?{ any; };
[root@test ~]#grep -v "^//" /etc/named.conf
options {
listen-on port 53 { localhost; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
allow-query { any; };
/*
- If you are building an AUTHORITATIVE DNS server,do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server,you need to enable
recursion.
- If your recursive DNS server has a public IP address,you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.root.key";
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
[root@test ~]#
说明：也可以选择注释listen-on port 53 { 127.0.0.1; };和allow-query? ? ?{ localhost; }; 这两行，这个配置文件的注释同C语言注释一样，用"//"来注释?
4）增加区域数据库文件的配置，从上面的配置文件中我们主要到最后两个include 的指令，其中include "/etc/named.rfc1912.zones"; 就是定义区域数据库文件的内容
[root@test ~]#cat >> /etc/named.rfc1912.zones << EOF
> zone "test.com" IN {
> type master;
> file "test.com.zone";
>
> };
> EOF
[root@test ~]#tail -5 /etc/named.rfc1912.zones
zone "test.com" IN {
type master;
file "test.com.zone";
};
[root@test ~]#
说明：以上配置是定义一个test.com的区域，其类型为master（主） ，区域数据库文件名为 “test.com.zone”,这里需要注意这个文件名是相对域/var/named这个目录的，也就说区域数据库文件必须存放在/var/named这个目录下。这个工作目录的定义可从主配置文件中的directory 这个选项来指定或更改
5）创建区域数据库文件
[root@test ~]#cat /var/named/test.com.zone
$TTL 1D
@ IN SOA dns1 admin ( 0 1D 1H 1W 3H );
NS dns1
dns1 A 192.168.0.99
www A 1.1.1.1
blog A 2.2.2.2
[root@test ~]#
说明：区域数据库文件的格式是name [TTL] IN rr_type value其中TTL可从全局继承，@可用于引用当前区域的名字，同一个名字可以通过多条记录定义多个不同的值；此时DNS服务器会以轮询方式响应。同一个值也可能有多个不同的定义名字；通过多个不同的名字指向同一个值进行定义；此仅表示通过多个不同的名字可以找到同一个主机；name: 当前区域的名字，例如“test.com”;?value: 有多部分组成,1、?当前区域的主DNS服务器的FQDN，也可以使用当前区域的名字；2、当前区域管理员的邮箱地址；但地址中不能使用@符号，一般用.替换，例如admin.test.com.? 3、主从服务区域传输相关定义以及否定的答案的统一的TTL;第一个数字表示序列号，第二个表示刷新时间，第三个表示主从服务器同步失败重试的时间间隔，第四个表示，从服务器同步失败后，多久数据文件内容过期，第五个表示缓存否定答案的TTL值。以上还需要注意的是名字没有以.结尾，默认会补上本域的名称
6）检查主配置文件和区域数据库文件是否正确，然后在启动服务
[root@test ~]#named-checkconf
[root@test ~]#named-checkzone test.com /var/named/test.com.zone
zone test.com/IN: loaded serial 0
OK
[root@test ~]#systemctl start named
[root@test ~]#
7）测试
[root@test ~]#dig www.test.com @192.168.0.99
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> www.test.com @192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY,status: NOERROR,id: 14227
;; flags: qr aa rd ra; QUERY: 1,ANSWER: 1,AUTHORITY: 1,ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0,flags:; udp: 4096
;; QUESTION SECTION:
;www.test.com. IN A
;; ANSWER SECTION:
www.test.com. 86400 IN A 1.1.1.1
;; AUTHORITY SECTION:
test.com. 86400 IN NS dns1.test.com.
;; ADDITIONAL SECTION:
dns1.test.com. 86400 IN A 192.168.0.99
;; Query time: 0 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: 日 12月 29 23:29:46 CST 2019
;; MSG SIZE rcvd: 92
[root@test ~]#dig blog.test.com @192.168.0.99
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> blog.test.com @192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY,id: 62941
;; flags: qr aa rd ra; QUERY: 1,flags:; udp: 4096
;; QUESTION SECTION:
;blog.test.com. IN A
;; ANSWER SECTION:
blog.test.com. 86400 IN A 2.2.2.2
;; AUTHORITY SECTION:
test.com. 86400 IN NS dns1.test.com.
;; ADDITIONAL SECTION:
dns1.test.com. 86400 IN A 192.168.0.99
;; Query time: 0 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: 日 12月 29 23:29:57 CST 2019
;; MSG SIZE rcvd: 93
[root@test ~]#
说明：dig工具来自bind-utils这个包，这个包主要是测试工具，包括host工具，dig工具，nslookup工具等测试工具。从上面的测试数据看，正向主DNS服务是搭建成功的。
8）在/etc/named.rfc1912.zones文件中添加反向区域文件的配置
[root@test ~]#tail -4 /etc/named.rfc1912.zones
zone "0.168.192.in-addr.arpa" {
type master;
file "192.168.0.zone";
};
[root@test ~]#
说明：反向DNS的区域必须将IP地址倒着写，且后面必须是.in-addr.arpa结尾? 里面的文件名称可任意填写，这里的文件名称也是必须放在/var/named这个目录下，同正向区域数据文件放在一个目录
9）创建反向区域数据文件
[root@test ~]#cat /var/named/192.168.0.zone
$TTL 1D
@ IN SOA dns1 admin (0 3H 10M 1D 1H );
NS dns1
dns1 A 192.168.0.99
99 PTR dns1.test.com.
100 PTR www.test.com.
101 PTR blog.test.com.
[root@test ~]#
说明：反向区域数据库文件同正向区域数据库文件格式相同，反向记录必须是PTR 类型其他同正向区域数据库文件类似，这里还需要注意一点的是，PTR后面的域名必须以.结尾，否则它会默认给你补本域的信息上去。
10）检查区域文件，重新读取配置文件，时期反向区域数据库文件生效
[root@test ~]#named-checkzone 192.168.0.zone /var/named/192.168.0.zone
zone 192.168.0.zone/IN: loaded serial 0
OK
[root@test ~]#rndc reload
server reload successful
[root@test ~]#
11)测试反向解析
[root@test ~]#dig -x 192.168.0.99 @192.168.0.99
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> -x 192.168.0.99 @192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY,id: 61308
;; flags: qr aa rd ra; QUERY: 1,flags:; udp: 4096
;; QUESTION SECTION:
;99.0.168.192.in-addr.arpa. IN PTR
;; ANSWER SECTION:
99.0.168.192.in-addr.arpa. 86400 IN PTR dns1.test.com.
;; AUTHORITY SECTION:
0.168.192.in-addr.arpa. 86400 IN NS dns1.0.168.192.in-addr.arpa.
;; ADDITIONAL SECTION:
dns1.0.168.192.in-addr.arpa. 86400 IN A 192.168.0.99
;; Query time: 0 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: 日 12月 29 23:58:39 CST 2019
;; MSG SIZE rcvd: 116
[root@test ~]#dig -x 192.168.0.100 @192.168.0.99
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> -x 192.168.0.100 @192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY,id: 23462
;; flags: qr aa rd ra; QUERY: 1,flags:; udp: 4096
;; QUESTION SECTION:
;100.0.168.192.in-addr.arpa. IN PTR
;; ANSWER SECTION:
100.0.168.192.in-addr.arpa. 86400 IN PTR www.test.com.
;; AUTHORITY SECTION:
0.168.192.in-addr.arpa. 86400 IN NS dns1.0.168.192.in-addr.arpa.
;; ADDITIONAL SECTION:
dns1.0.168.192.in-addr.arpa. 86400 IN A 192.168.0.99
;; Query time: 0 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: 日 12月 29 23:58:50 CST 2019
;; MSG SIZE rcvd: 116
[root@test ~]#dig -x 192.168.0.101 @192.168.0.99
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> -x 192.168.0.101 @192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY,id: 17401
;; flags: qr aa rd ra; QUERY: 1,flags:; udp: 4096
;; QUESTION SECTION:
;101.0.168.192.in-addr.arpa. IN PTR
;; ANSWER SECTION:
101.0.168.192.in-addr.arpa. 86400 IN PTR blog.test.com.
;; AUTHORITY SECTION:
0.168.192.in-addr.arpa. 86400 IN NS dns1.0.168.192.in-addr.arpa.
;; ADDITIONAL SECTION:
dns1.0.168.192.in-addr.arpa. 86400 IN A 192.168.0.99
;; Query time: 0 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: 日 12月 29 23:58:58 CST 2019
;; MSG SIZE rcvd: 117
[root@test ~]#
说明：可看到我们分别把192.168.0.99、100、101这三个主机对应的主机名给解析出来了，这里不要同前面的正向区域数据库中的数据混淆，这个反向解析可把不同的ip解析成相同的名字，这个和正向解析本质上没有联系。它相当于是两个不同的域，互不干扰。
到此dns主服务器就搭建完毕，接下来实现DNS从服务器
1）在上面的实验上把主服务器上的配置文件中添加 allow_transfer { 192.168.0.151;};,并且在其数据库文件中添加从服务器的NS记录 以及A记录
[root@test ~]#grep "transfer" /etc/named.conf
allow-transfer { 192.168.0.151; };
[root@test ~]#cat /var/named/test.com.zone
$TTL 1D
@ IN SOA dns1 admin ( 0 1D 1H 1W 3H );
NS dns1
NS dns2
dns1 A 192.168.0.99
dns2 A 192.168.0.151
www A 1.1.1.1
blog A 2.2.2.2
[root@test ~]#cat /var/named/192.168.0.zone
$TTL 1D
@ IN SOA dns1 admin (0 3H 10M 1D 1H );
NS dns1
NS dns2
dns1 A 192.168.0.99
dns2 A 192.168.0.151
99 PTR dns1.test.com.
100 PTR www.test.com.
101 PTR blog.test.com.
[root@test ~]#
2）在从服务器上安装bind包，并在其配置文件中配置 allow-transfer {none;}; 并注释listen-on port 53 { 127.0.0.1; };和allow-query? ? ?{ localhost; };
[root@test-node1 ~]#yum install -y bind
[root@test-node1 ~]#cat /etc/named.conf
……省略部分内容
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
// allow-query { localhost; };
allow-transfer { none; };
recursion yes;
……省略部分内容
3）在/etc/named.rfc1912.zonesz中配置区域数据文件信息
[root@test-node1 ~]#cat >> /etc/named.rfc1912.zones << EOF
> zone "test.com" {
> type slave;
> masters {192.168.0.99;};
> file "slaves/test.com.zone";
> };
> EOF
[root@test-node1 ~]#cat >> /etc/named.rfc1912.zones << EOF
> zone "0.168.192.in-addr.arpa" {
> type slave;
> masters { 192.168.0.99; };
> file "slaves/192.168.0.zone";
> };
> EOF
[root@test-node1 ~]#
[root@test-node1 ~]#tail /etc/named.rfc1912.zones
zone "test.com" {
type slave;
masters {192.168.0.99;};
file "slaves/test.com.zone";
};
zone "0.168.192.in-addr.arpa" {
type slave;
masters { 192.168.0.99; };
file "slaves/192.168.0.zone";
};
[root@test-node1 ~]#
说明：在从服务器上需要写明区域的名称，类型配成slave，并指明masters ，后面的files 是同步文件的存放地，这个存放地需要named这个账号有写的权限，否则将无法完成同步
4）在从服务器上检查配置文件，并启动服务
[root@test-node1 ~]#ll /var/named/slaves/
total 0
[root@test-node1 ~]#named-checkconf
[root@test-node1 ~]#/etc/init.d/named start
Generating /etc/rndc.key: [ OK ]
Starting named: [ OK ]
[root@test-node1 ~]#ll /var/named/slaves/
total 8
-rw-r--r-- 1 named named 449 Dec 30 00:35 192.168.0.zone
-rw-r--r-- 1 named named 336 Dec 30 00:35 test.com.zone
[root@test-node1 ~]#
说明：启动服务后可看到/var/named/slaves/目录下把我们需要的区域数据库文件给同步过来了，接下来测试，在另一台主机上把DNS1设置成主DNS服务器地址，DNS2设置成从DNS服务器地址，然后在主挂掉的情况下，看下从DNS是否可工作
5）测试
[root@ansible_centos6 ~]# cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 192.168.0.99
nameserver 192.168.0.151
[root@ansible_centos6 ~]# dig www.test.com
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6 <<>> www.test.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY,id: 22293
;; flags: qr aa rd ra; QUERY: 1,ADDITIONAL: 1
;; QUESTION SECTION:
;www.test.com. IN A
;; ANSWER SECTION:
www.test.com. 86400 IN A 1.1.1.1
;; AUTHORITY SECTION:
test.com. 86400 IN NS dns1.test.com.
;; ADDITIONAL SECTION:
dns1.test.com. 86400 IN A 192.168.0.99
;; Query time: 4 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: Mon Dec 30 00:46:46 2019
;; MSG SIZE rcvd: 81
[root@ansible_centos6 ~]# dig -x 192.168.0.99
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6 <<>> -x 192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY,id: 48024
;; flags: qr aa rd ra; QUERY: 1,ADDITIONAL: 1
;; QUESTION SECTION:
;99.0.168.192.in-addr.arpa. IN PTR
;; ANSWER SECTION:
99.0.168.192.in-addr.arpa. 86400 IN PTR dns1.test.com.
;; AUTHORITY SECTION:
0.168.192.in-addr.arpa. 86400 IN NS dns1.0.168.192.in-addr.arpa.
;; ADDITIONAL SECTION:
dns1.0.168.192.in-addr.arpa. 86400 IN A 192.168.0.99
;; Query time: 3 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: Mon Dec 30 00:47:00 2019
;; MSG SIZE rcvd: 105
[root@ansible_centos6 ~]#
说明：这是主DNS存活情况下的测试是可以正常解析
主DNS挂掉的情况
[root@ansible_centos6 ~]# dig www.test.com
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6 <<>> www.test.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY,id: 21730
;; flags: qr aa rd ra; QUERY: 1,ADDITIONAL: 1
;; QUESTION SECTION:
;www.test.com. IN A
;; ANSWER SECTION:
www.test.com. 86400 IN A 1.1.1.1
;; AUTHORITY SECTION:
test.com. 86400 IN NS dns1.test.com.
;; ADDITIONAL SECTION:
dns1.test.com. 86400 IN A 192.168.0.99
;; Query time: 1 msec
;; SERVER: 192.168.0.151#53(192.168.0.151)
;; WHEN: Mon Dec 30 00:50:43 2019
;; MSG SIZE rcvd: 81
[root@ansible_centos6 ~]# dig -x 192.168.0.99
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6 <<>> -x 192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY,id: 63933
;; flags: qr aa rd ra; QUERY: 1,ADDITIONAL: 1
;; QUESTION SECTION:
;99.0.168.192.in-addr.arpa. IN PTR
;; ANSWER SECTION:
99.0.168.192.in-addr.arpa. 86400 IN PTR dns1.test.com.
;; AUTHORITY SECTION:
0.168.192.in-addr.arpa. 86400 IN NS dns1.0.168.192.in-addr.arpa.
;; ADDITIONAL SECTION:
dns1.0.168.192.in-addr.arpa. 86400 IN A 192.168.0.99
;; Query time: 1 msec
;; SERVER: 192.168.0.151#53(192.168.0.151)
;; WHEN: Mon Dec 30 00:50:55 2019
;; MSG SIZE rcvd: 105
[root@ansible_centos6 ~]#
说明：可看到主DNS服务器挂掉，从服务器是可以提供服务的，况且查询的内容同主的一模一样
2、搭建并实现智能DNS。
? ? 1）在上面的实验环境中，更改配置文件
[root@test ~]#cat /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html
acl cdnet {
192.168.0.0/24;
};
acl bjnet {
172.16.1.0/24;
};
acl shnet {
any;
};
options {
listen-on port 53 { localhost; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
allow-query { any; };
allow-transfer { 192.168.0.151; };
/*
- If you are building an AUTHORITATIVE DNS server,you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.root.key";
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
include "/etc/named.root.key";
view view_cd {
match-clients {cdnet;};
include "/etc/named.zone.cd";
include "/etc/named.rfc1912.zones";
};
view view_bj {
match-clients { bjnet; };
include "/etc/named.zone.bj";
include "/etc/named.rfc1912.zones";
};
view view_sh {
match-clients { shnet; };
include "/etc/named.zone.sh"；
include "/etc/named.rfc1912.zones";
};
[root@test ~]#
说明：这个是主配置文件，主要添加了 3段acl和3段view 这里需要注意一点的是，一旦配置了view，所有的区域配置必须写在view中，所有我们还需要把根区域的配置文件到/etc/named.rfc1912.zones里 ，然后在view 里用include 把区域配置文件导入即可，借鉴上面的思想，我们也可以把不同地区的区域配置文件也用不同的文件给存起来，实现方便管理，然后也用include 指定导入到各自的view，这样就实现了 不同的网络客户端，访问不同的区域文件。最后我们还需要建立各自的区域数据库文件。
2）把根区域配置文件放入到/etc/named.rfc1912.zones
[root@test ~]#cat /etc/named.rfc1912.zones
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
zone "." IN {
type hint;
file "named.ca";
};
zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
};
zone "1.0.0.127.in-addr.arpa" IN {
type master;
file "named.loopback";
allow-update { none; };
};
zone "0.in-addr.arpa" IN {
type master;
file "named.empty";
allow-update { none; };
};
zone "0.168.192.in-addr.arpa" {
type master;
file "192.168.0.zone";
};
[root@test ~]#
3）创建各自的区域配置文件
[root@test ~]#cat >> /etc/named.zone.cd << EOF
> zone "test.com" IN {
> type master;
> file "test.com.zone.cd";
> };
> EOF
[root@test ~]#cat >> /etc/named.zone.bj << EOF
> zone "test.com" IN {
> type master;
> file "test.com.zone.bj";
> };
> EOF
[root@test ~]#cat >> /etc/named.zone.sh << EOF
> zone "test.com" IN {
> type master;
> file "test.com.zone.sh";
> };
> EOF
[root@test ~]#cat /etc/named.zone.cd
zone "test.com" IN {
type master;
file "test.com.zone.cd";
};
[root@test ~]#cat /etc/named.zone.bj
zone "test.com" IN {
type master;
file "test.com.zone.bj";
};
[root@test ~]#cat /etc/named.zone.sh
zone "test.com" IN {
type master;
file "test.com.zone.sh";
};
[root@test ~]#
4）准备各自区域的数据库文件
[root@test ~]#cat /var/named/test.com.zone.cd
$TTL 1D
@ IN SOA dns1 admin ( 0 2D 1H 3D 1D )
NS dns1
dns1 A 192.168.0.99
www A 3.3.3.3
blog A 4.4.4.4
[root@test ~]#cat /var/named/test.com.zone.bj
$TTL 1D
@ IN SOA dns1 admin ( 0 2D 1H 3D 1D )
NS dns1
dns1 A 192.168.0.99
www A 5.5.5.5
blog A 6.6.6.6
[root@test ~]#cat /var/named/test.com.zone.sh
$TTL 1D
@ IN SOA dns1 admin ( 0 2D 1H 3D 1D )
NS dns1
dns1 A 192.168.0.99
www A 7.7.7.7
blog A 8.8.8.8
[root@test ~]#
[root@test ~]#ll /var/named/
总用量 36
-rw-r--r-- 1 root root 188 12月 30 00:28 192.168.0.zone
drwxrwx--- 2 named named 23 12月 29 23:23 data
drwxrwx--- 2 named named 60 12月 30 01:01 dynamic
-rw-r----- 1 root named 2253 4月 5 2018 named.ca
-rw-r----- 1 root named 152 12月 15 2009 named.empty
-rw-r----- 1 root named 152 6月 21 2007 named.localhost
-rw-r----- 1 root named 168 12月 15 2009 named.loopback
drwxrwx--- 2 named named 6 8月 8 20:16 slaves
-rw-r--r-- 1 root root 154 12月 30 00:10 test.com.zone
-rw-r--r-- 1 root root 112 12月 30 21:33 test.com.zone.bj
-rw-r--r-- 1 root root 112 12月 30 21:31 test.com.zone.cd
-rw-r--r-- 1 root root 117 12月 30 21:35 test.com.zone.sh
[root@test ~]#find /var/named/ -name "test.com.zone*"
/var/named/test.com.zone
/var/named/test.com.zone.cd
/var/named/test.com.zone.bj
/var/named/test.com.zone.sh
[root@test ~]#find /var/named/ -name "test.com.zone*"|xargs chown root.named
[root@test ~]#ll /var/named/
总用量 36
-rw-r--r-- 1 root root 188 12月 30 00:28 192.168.0.zone
drwxrwx--- 2 named named 23 12月 29 23:23 data
drwxrwx--- 2 named named 60 12月 30 01:01 dynamic
-rw-r----- 1 root named 2253 4月 5 2018 named.ca
-rw-r----- 1 root named 152 12月 15 2009 named.empty
-rw-r----- 1 root named 152 6月 21 2007 named.localhost
-rw-r----- 1 root named 168 12月 15 2009 named.loopback
drwxrwx--- 2 named named 6 8月 8 20:16 slaves
-rw-r--r-- 1 root named 154 12月 30 00:10 test.com.zone
-rw-r--r-- 1 root named 112 12月 30 21:33 test.com.zone.bj
-rw-r--r-- 1 root named 112 12月 30 21:31 test.com.zone.cd
-rw-r--r-- 1 root named 117 12月 30 21:35 test.com.zone.sh
[root@test ~]#
[root@test ~]#find /var/named/ -name "test.com.zone*"|xargs chmod o-r
[root@test ~]#ll /var/named/
总用量 36
-rw-r--r-- 1 root root 188 12月 30 00:28 192.168.0.zone
drwxrwx--- 2 named named 23 12月 29 23:23 data
drwxrwx--- 2 named named 60 12月 30 01:01 dynamic
-rw-r----- 1 root named 2253 4月 5 2018 named.ca
-rw-r----- 1 root named 152 12月 15 2009 named.empty
-rw-r----- 1 root named 152 6月 21 2007 named.localhost
-rw-r----- 1 root named 168 12月 15 2009 named.loopback
drwxrwx--- 2 named named 6 8月 8 20:16 slaves
-rw-r----- 1 root named 154 12月 30 00:10 test.com.zone
-rw-r----- 1 root named 112 12月 30 21:33 test.com.zone.bj
-rw-r----- 1 root named 112 12月 30 21:31 test.com.zone.cd
-rw-r----- 1 root named 117 12月 30 21:35 test.com.zone.sh
[root@test ~]#
说明：通过上面的配置后，我们最终希望各自的地区的用户访问各自区域的数据文件，从而实现了不同区域的用户，获取不同ip地址信息。这里还是建议把新建的权限属组给改成named,虽然不改是可以的，但是权限比较大，应该只允许named有读权限就好了。
5）检查配置文件，重启服务
[root@test ~]#named-checkconf
[root@test ~]#named-checkzone test.com /var/named/test.com.zone.cd
zone test.com/IN: loaded serial 0
OK
[root@test ~]#named-checkzone test.com /var/named/test.com.zone.bj
zone test.com/IN: loaded serial 0
OK
[root@test ~]#named-checkzone test.com /var/named/test.com.zone.sh
zone test.com/IN: loaded serial 0
OK
[root@test ~]#rndc reload
server reload successful
[root@test ~]#
6）测试
模拟成都的用户访问DNS
[qiuhom@test-node1 ~]$ip a l
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:24:81:68:ce:45 brd ff:ff:ff:ff:ff:ff
inet 192.168.0.151/24 brd 192.168.0.255 scope global eth0
inet6 fe80::224:81ff:fe68:ce45/64 scope link
valid_lft forever preferred_lft forever
[qiuhom@test-node1 ~]$
[qiuhom@test-node1 ~]$dig www.test.com @192.168.0.99
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6_10.3 <<>> www.test.com @192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY,id: 51022
;; flags: qr aa rd ra; QUERY: 1,ADDITIONAL: 1
;; QUESTION SECTION:
;www.test.com. IN A
;; ANSWER SECTION:
www.test.com. 86400 IN A 3.3.3.3
;; AUTHORITY SECTION:
test.com. 86400 IN NS dns1.test.com.
;; ADDITIONAL SECTION:
dns1.test.com. 86400 IN A 192.168.0.99
;; Query time: 2 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: Mon Dec 30 22:20:02 2019
;; MSG SIZE rcvd: 81
[qiuhom@test-node1 ~]$dig blog.test.com @192.168.0.99
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6_10.3 <<>> blog.test.com @192.168.0.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY,id: 4979
;; flags: qr aa rd ra; QUERY: 1,ADDITIONAL: 1
;; QUESTION SECTION:
;blog.test.com. IN A
;; ANSWER SECTION:
blog.test.com. 86400 IN A 4.4.4.4
;; AUTHORITY SECTION:
test.com. 86400 IN NS dns1.test.com.
;; ADDITIONAL SECTION:
dns1.test.com. 86400 IN A 192.168.0.99
;; Query time: 1 msec
;; SERVER: 192.168.0.99#53(192.168.0.99)
;; WHEN: Mon Dec 30 22:20:12 2019
;; MSG SIZE rcvd: 82
[qiuhom@test-node1 ~]$
说明:通过192.168.0.0/24主机访问的结果是指定view里指定的数据库文件的内容.
模拟北京的用户访问DNS
[root@test ~]#ip a l
1: lo: <LOOPBACK,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp2s0: <BROADCAST,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:30:18:51:af:3c brd ff:ff:ff:ff:ff:ff
inet 192.168.0.99/24 brd 192.168.0.255 scope global noprefixroute enp2s0
valid_lft forever preferred_lft forever
inet 172.16.1.2/16 brd 172.16.255.255 scope global noprefixroute enp2s0:0
valid_lft forever preferred_lft forever
inet6 fe80::230:18ff:fe51:af3c/64 scope link
valid_lft forever preferred_lft forever
3: enp3s0: <NO-CARRIER,BROADCAST,UP> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
link/ether 00:30:18:51:af:3d brd ff:ff:ff:ff:ff:ff
4: docker0: <NO-CARRIER,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:d6:07:f1:b0 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 scope global docker0
valid_lft forever preferred_lft forever
[root@test ~]#dig www.test.com @172.16.1.2
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> www.test.com @172.16.1.2
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY,id: 33773
;; flags: qr aa rd ra; QUERY: 1,flags:; udp: 4096
;; QUESTION SECTION:
;www.test.com. IN A
;; ANSWER SECTION:
www.test.com. 86400 IN A 5.5.5.5
;; AUTHORITY SECTION:
test.com. 86400 IN NS dns1.test.com.
;; ADDITIONAL SECTION:
dns1.test.com. 86400 IN A 192.168.0.99
;; Query time: 0 msec
;; SERVER: 172.16.1.2#53(172.16.1.2)
;; WHEN: 一 12月 30 22:24:07 CST 2019
;; MSG SIZE rcvd: 92
[root@test ~]#dig blog.test.com @172.16.1.2
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> blog.test.com @172.16.1.2
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY,id: 8001
;; flags: qr aa rd ra; QUERY: 1,flags:; udp: 4096
;; QUESTION SECTION:
;blog.test.com. IN A
;; ANSWER SECTION:
blog.test.com. 86400 IN A 6.6.6.6
;; AUTHORITY SECTION:
test.com. 86400 IN NS dns1.test.com.
;; ADDITIONAL SECTION:
dns1.test.com. 86400 IN A 192.168.0.99
;; Query time: 0 msec
;; SERVER: 172.16.1.2#53(172.16.1.2)
;; WHEN: 一 12月 30 22:24:18 CST 2019
;; MSG SIZE rcvd: 93
[root@test ~]#
模拟上海的用户访问DNS
[root@test ~]#dig www.test.com @127.0.0.1
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> www.test.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY,id: 50994
;; flags: qr aa rd ra; QUERY: 1,flags:; udp: 4096
;; QUESTION SECTION:
;www.test.com. IN A
;; ANSWER SECTION:
www.test.com. 86400 IN A 7.7.7.7
;; AUTHORITY SECTION:
test.com. 86400 IN NS dns1.test.com.
;; ADDITIONAL SECTION:
dns1.test.com. 86400 IN A 192.168.0.99
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: 一 12月 30 22:25:52 CST 2019
;; MSG SIZE rcvd: 92
[root@test ~]#dig blog.test.com @127.0.0.1
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> blog.test.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY,id: 10062
;; flags: qr aa rd ra; QUERY: 1,flags:; udp: 4096
;; QUESTION SECTION:
;blog.test.com. IN A
;; ANSWER SECTION:
blog.test.com. 86400 IN A 8.8.8.8
;; AUTHORITY SECTION:
test.com. 86400 IN NS dns1.test.com.
;; ADDITIONAL SECTION:
dns1.test.com. 86400 IN A 192.168.0.99
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: 一 12月 30 22:25:58 CST 2019
;; MSG SIZE rcvd: 93
[root@test ~]#
说明：在本机使用127.0.0.1 去查，named会走回环地址去访问DNS，这个时候acl就会匹配到shnet ，从而访问view_sh说指定的区域数据库文件内容。这里要注意一点就是acl它默认是从上往下匹配，若匹配到就不往下匹配，所以127.0.0.1 既不属于192.168.0.0/24 这个网络，也不属于172.16.1.0/24这个网络，所以它会被any匹配到。
到此智能DNS的搭建就完成了，事实上智能DNS的主要作用就是智能的区分不同来源的用户访问不同的区域文件，从而实现用户访问到的DNS是离自己最近的服务器，在互联网中的应用有CDN（内容分发网络），它的背后实现就是智能DNS。把不同的区域的用户通过智能DNS分别分向不同地区的DNS服务器上去，从而实现了用户访问网站的服务器是离自己最近的服务器，CDN实现了加快用户的访问同时还减轻了网站主服务器的压力和带宽。