智能DNS安裝與配置

火星人 @ 2014-03-29 , reply:0
←手機掃碼閱讀


  註:對於配置智能DNS,主要用途為:1、解決網通與電信問題 2、實現區域規劃(不同區域訪問各自最近的伺服器),下面以解決網通與電信連接問題的配置。至於實現2的功能,只需稍加更改即可。

一、DNS伺服器安裝......................................................................................... 1

二、named.conf的配置....................................................................................... 2

三、更新根區文件:.......................................................................................... 3

四、建立啟動腳本:.......................................................................................... 4

五、添加一個NS............................................................................................... 5

六、添加一個域名.............................................................................................. 5

附:獲取IP地址範圍方法:................................................................................. 7




一、DNS伺服器安裝


1、 軟體列表

BIND 9.3.2

ftp://ftp.isc.org/isc/bind9/9.3.2/bind-9.3.2.tar.gz

2、 安裝BIND 9

安裝BIND9:

# tar zxvf bind-9.3.2.tar.gz

# cd bind-9.3.2

# ./configure

--prefix=/usr/local/named

--disable-ipv6

# make && make install

建立BIND用戶:

# groupadd bind

# useradd -g bind -d /usr/local/named -s /sbin/nologin bind

創建配置文件目錄:

# mkdir ?p /usr/local/named/etc

# chown bind:bind /usr/local/named/etc

# chmod 700 /usr/local/named/etc



二、named.conf的配置


創建主要的配置文件:

# vi /usr/local/named/etc/named.conf

===========================named.conf=======================

acl "trust-lan" { 127.0.0.1/8; 192.168.0.0/16;};

options {

directory "/usr/local/named/etc/";

pid-file "/var/run/named/named.pid";

version "0.0.0";

datasize 40M;

allow-transfer {

"trust-lan";};

recursion yes;

allow-notify {

"trust-lan";

};

allow-recursion {

"trust-lan";

};

auth-nxdomain no;

forwarders {

202.99.160.68;

202.99.168.8;};

};

logging {

channel warning

{ file "/var/log/named/dns_warnings" versions 3 size 1240k;

severity warning;

print-category yes;

print-severity yes;

print-time yes;

};

channel general_dns

{ file "/var/log/named/dns_logs" versions 3 size 1240k;

severity info;

print-category yes;

print-severity yes;

print-time yes;

};

category default { warning; };

category queries { general_dns; };

};

zone "." {

type hint;

file "named.root";

};

acl "CNC" {

58.16.0.0/16;

58.17.0.0/17;

58.17.128.0/17;

58.18.0.0/16;

58.19.0.0/16;

58.20.0.0/16;

58.21.0.0/16;

註:這些根據情況輸入IP地址段

};

view "view_cnc" {

match-clients { CNC; };

zone "." {

type hint;

file "named.root";

};

zone "0.0.127.IN-ADDR.ARPA" {

type master;

file "localhost.rev";

};

include "master/cnc.def";

};

view "view_any" {

match-clients { any; };

zone "." {

type hint;

file "named.root";

};

zone "0.0.127.IN-ADDR.ARPA" {

type master;

file "localhost.rev";

};

include "master/telecom.def";

};

添加完成後,保存。



三、更新根區文件:


# cd /usr/local/named/etc/

# wget ftp://ftp.internic.org/domain/named.root

創建PID和日誌文件:

# mkdir /var/run/named/

# chmod 777 /var/run/named/

# chown bind:bind /var/run/named/

# mkdir /var/log/named/

# touch /var/log/named/dns_warnings

# touch /var/log/named/dns_logs

# chown bind:bind /var/log/named/*

# mkdir master

# touch master/cnc.def

# touch master/telecom.def

生成rndc-key:

# cd /usr/local/named/etc/

# ../sbin/rndc-confgen > rndc.conf

把rndc.conf中:

# Use with the following in named.conf, adjusting the allow list as needed:

後面以的部分加到/usr/local/named/etc/named.conf中並去掉註釋

運行測試:

# /usr/local/named/sbin/named -gc /usr/local/named/etc/named.conf &

狀態檢查:

# /usr/local/named/sbin/rndc status



四、建立啟動腳本:


# vi /etc/init.d/named

============================== named.sh============================

#!/bin/bash

#

# named a network name service.

#

#

# chkconfig: 545 35 75

# description: a name server

#

if [ `id -u` -ne 0 ]

then

echo "ERROR:For bind to port 53,must run as root."

exit 1

fi

case "$1" in

start)

if [ -x /usr/local/named/sbin/named ]; then

/usr/local/named/sbin/named -u bind -c /usr/local/named/etc/named.conf && echo . && echo 'BIND9 server started.'

fi

;;

stop)

kill `cat /var/run/named/pid` && echo . && echo 'BIND9 server stopped.'

;;

restart)

echo .

echo "Restart BIND9 server"

$0 stop

sleep 10

$0 start

;;

*)

echo "$0 start | stop | restart"

;;

esac

===============================named.sh============================

# chmod 755 /etc/init.d/named

# chown root:root /etc/init.d/named

# chkconfig --add named

# chkconfig named on



五、添加一個NS


在域名的管理網站上,設定NS伺服器為你安裝的DNS



六、添加一個域名


# cd /usr/local/named/etc/master

# mkdir cnc

# mkdir telecom

# vi cnc.def

添加

zone "daoyou.com" {

type master;

file "master/cnc/daoyou.com";

};

# vi telecom.def

添加

zone "daoyou.com" {

type master;

file "master/telecom/daoyou.com";

};

添加網通的解析,解析到的IP為61.45.55.78

#vi cnc/daoyou.com

添加

$TTL 3600

$ORIGIN daoyou.com.

@ IN SOA ns.daoyou.com. root.ns.daoyou.com.(

2005121013 ;Serial

3600 ; Refresh ( seconds )

900 ; Retry ( seconds )

68400 ; Expire ( seconds )

15 );Minimum TTL for Zone ( seconds )

;

@ IN NS ns.daoyou.com.

@ IN A 61.45.55.78

www IN A 61.45.55.78

;

;end

添加電信的解析,解析到的IP為210.75.1.178

#vi telecom/daoyou.com

添加

$TTL 3600

$ORIGIN daoyou.com.

@ IN SOA ns.daoyou.com. root.ns.daoyou.com.(

2005121013 ;Serial

3600 ; Refresh ( seconds )

900 ; Retry ( seconds )

68400 ; Expire ( seconds )

15 );Minimum TTL for Zone ( seconds )

;

@ IN NS ns.daoyou.com.

@ IN A 210.75.1.178

www IN A 210.75.1.178

;

;end

#/usr/local/named/sbin/rndc reload

OK,到此你的DNS伺服器就算是跑起來了。試一下分別用網通和電信的線路ping一下吧.


附:獲取IP地址範圍方法:
1、 利用shell程序獲取IP地址段



#!/bin/sh

FILE=/root/study/apnic/ip_apnic

rm -f $FILE

wget http://ftp.apnic.net/apnic/stats/apnic/delegated-apnic-latest -O $FILE

grep 'apnic|CN|ipv4|' $FILE | cut -f 4,5 -d'|'|sed -e 's/|/ /g' | while read ip cnt

do

echo $ip:$cnt

mask=$(cat << EOF | bc | tail -1

pow=32;

define log2(x) {

if (x<=1) return (pow);

pow--;

return(log2(x/2));

}

log2($cnt)

EOF)

echo $ip/$mask>> cn.net

NETNAME=`whois $ip@whois.apnic.net | sed -e '/./{H;$!d;}' -e 'x;/netnum/!d' |grep ^netname | sed -e 's/.*: \(.*\)/\1/g' | sed -e 's/-.*//g'`

case $NETNAME in

CNC)

echo $ip/$mask >> CNCGROUP

;;

CHINANET|CNCGROUP)

echo $ip/$mask >> $NETNAME

;;

CHINANET|CNCGROUP)

echo $ip/$mask >> $NETNAME

;;

CHINATELECOM)

echo $ip/$mask >> CHINANET

;;

*)

echo $ip/$mask >> OTHER

;;

esac

done



2、 可以利用網上的資料,下面是最新的信息,然後利awk行成地址段即可。


wget http://218.66.103.230/vpn_route/cnc.new 新的網通路由表

wget http://218.66.103.230/vpn_route/chinanet.new 新的電信路由表




[火星人 via ] 智能DNS安裝與配置已經有211次圍觀

http://www.coctec.com/docs/linux/show-post-204270.html