DNS域名解析服务（二）——配置主从域名服务器和分离解析
<h1>一、配置主从DNS服务器</h1><h2>1、配置主从DNS服务器的步骤</h2>
<h3><span style="font-family: "Microsoft YaHei"; font-size: 18px">1.1 修改主域名服务器的区域配置文件，修改正、反向区域配置</span></h3>
<div class="cnblogs_Highlighter">
<pre class="brush:bash;gutter:true;"> vim /etc/named.rfc1912.zones #修改区域配置文件
1.正向区域的配置
zone "clj.com" IN {
type master; #类型为主区域
file "clj.com.zone";
allow-update { none; }; #允许从服务器下载正向区域数据，这里添从服务器的IP地址
};
2.反向区域的配置
zone "80.168.192.in-addr.arpa" IN {
type master; #类型为主区域
file "clj.com.zone.local";
allow-update { none; }; #允许从服务器下载正向区域数据，这里添从服务器的IP地址
};
</pre>
</div>
<h3><span style="font-family: "Microsoft YaHei"; font-size: 18px">1.2.修改从服务器的主配置文件</span></h3>
<div class="cnblogs_Highlighter">
<pre class="brush:bash;gutter:true;">options {
listen-on port 53 { 192.168.80.80; }; #监听53端口，ip地址使用提供服务的地址ip，也可以用any代表所有
# listen-on-v6 port 53 { ::1; }; #ipv6不需要，注释即可
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file"/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
allow-query { any; }; #允许使用本DNS解析服务的网段，也可以用any
...}
</pre>
</div>
<h3><span style="font-family: "Microsoft YaHei"; font-size: 18px">1.3、.修改从服务器的区域配置文件，添加正反区域配置</span></h3>
<div class="cnblogs_Highlighter">
<pre class="brush:bash;gutter:true;">zone "clj.com" IN {
type slave; #指定类型为从区域
masters { 192.168.80.78}; #指定主服务器的ip地址
file "slaves/clj.com.zone"; #下载的区域数据文件保存到slaves目录下
};
zone "80.168.192.in-addr.arpa" IN {
type slave;
masters { 192.168.80.78};
file "slaves/clj.com.zone.local";
};
</pre>
</div>
<h3><span style="font-family: "Microsoft YaHei"; font-size: 18px">1.4.主从服务器都需要关闭防火墙，安全防护并且重启服务，并查看区域数据文件是否已下载成功，<span style="background-color: rgba(0, 255, 255, 1)">最后配置临时DNS地址。</span></span></h3>
<div class="cnblogs_Highlighter">
<pre class="brush:bash;gutter:true;">systemctl stop firewall #关闭防火墙
setenforce 0 #关闭安全防护功能
systemctl restart named #重启服务
主域名服务器:
vim /etc/resolv.conf #修改临时域名ip
nameserver 192.168.80.78 #主域名服务器的ip
nameserver 192.168.80.80 #从域名服务器的ip
从域名服务器:
vim /etc/resolv.conf #修改临时域名ip
nameserver 192.168.80.80 #从域名服务器的ip
nameserver 192.168.80.78 #主域名服务器的ip
</pre>
</div>
<h3><span style="font-family: "Microsoft YaHei"; font-size: 18px">1.5.测试并模拟故障</span></h3>
<div class="cnblogs_Highlighter">
<pre class="brush:bash;gutter:true;">nslookup www.clj.com #测试解析域名
nslookup 192.168.80.100 #测试解析ip
systemctl stop named #停止named服务
nslookup www.clj.com
nslookup 192.168.80.100
</pre>
</div>
<h1>二、实例操作一：配置主从DNS服务器</h1>
<h2>1.开启一台新的虚拟机，yum安装bind</h2>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701001155785-1137767630.png" alt="" loading="lazy"> </p>
<h2>2、修改主域名服务器的区域配置文件，修改正、反向区域配置 </h2>
<p> <img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701002157907-1991558027.png" alt="" loading="lazy"> </p>
<h2>3、添加从服务器的ip地址（将从服务器的Ip也添加进去）</h2>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701002946856-1104555341.png" alt="" loading="lazy"></p>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701003338851-639223221.png" alt="" loading="lazy"></p>
<h2>4.修改从域名服务器的主配置文件（开启新的服务器）</h2>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701003951661-513432337.png" alt="" loading="lazy"></p>
<h2>5 、修改从域名服务器的区域配置文件</h2>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701084902521-850349586.png" alt="" loading="lazy"></p>
<h2>6、添加主服务器的ip地址（将主服务器的Ip也添加进去）</h2>
<p> <img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701084805350-843142219.png" alt="" loading="lazy"></p>
<h2> 7、在从服务中查看是否自动生成了区域资源配置文件（前提是关闭防火墙，开启服务）</h2>
<p> <img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701085751350-658672529.png" alt="" loading="lazy"></p>
<h2> 8、在从服务中进行域名解析测试（正反解析）</h2>
<p> <img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701090413283-1700228681.png" alt="" loading="lazy"></p>
<h2> 9、在主服务中进行域名解析测试（并模拟主服务故障后，从服务能否正常运行）</h2>
<p> <img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701091613177-697152459.png" alt="" loading="lazy"></p>
<p> <img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701091622852-741637762.png" alt="" loading="lazy"></p>
<h1>三、DNS分离解析</h1>
<h2>1、配置DNS分离解析的步骤：</h2>
<p><span style="font-family: "Microsoft YaHei"; font-size: 18px; background-color: rgba(0, 255, 255, 1)">分离解析的域名服务器实际也是主域名服务器，这里主要是指根据不同的客户端提供不同的域名解析记录。比如来自内网和外网的不同网段地址区域的客户机请求解析同一域名时，为其提供不同的解析结果，得到不同的IP地址。</span></p>
<p><span style="font-family: "Microsoft YaHei"; font-size: 18px; background-color: rgba(255, 255, 255, 1)">配置网关服务器搭建DNS分离解析</span></p>
<p><span style="font-family: "Microsoft YaHei"; font-size: 18px">在网关服务器搭建DNS分离解析，使局域网主机解析www.ly.com为192.168.229.66，外网主机解析www.benet.com为12.0.0.6</span></p>
<h3><span style="font-family: "Microsoft YaHei"; font-size: 18px">1.1 为网关服务器配置双网卡，并且修改网卡配置</span></h3>
<div class="cnblogs_Highlighter">
<pre class="brush:bash;gutter:true;">在关机状态下再添加一块网卡，重启系统
ifconfig ens36 12.0.0.1/24
ifconfig
复制并修改网卡配置
cp ifcfg-ens33 ifcfg-ens36
vim /etc/sysconfig/network-script/ifcfg-ens33 #修改
</pre>
</div>
<h3><span style="font-family: "Microsoft YaHei"; font-size: 18px">1.2 安装bind软件包 </span> </h3>
<div class="cnblogs_Highlighter">
<pre class="brush:bash;gutter:true;">yum install -y bind
</pre>
</div>
<h3><span style="font-family: "Microsoft YaHei"; font-size: 18px">1.3 修改主配置文件</span></h3>
<div class="cnblogs_Highlighter">
<pre class="brush:bash;gutter:true;">options {
listen-on port 53 { any; }; #监听53端口，ip地址使用提供服务的地址ip，也可以用any代表所有
#listen-on-v6 port 53 { ::1; }; #ipv6不需要，注释即可
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; }; #允许使用本DNS解析服务的网段，也可以用any
</pre>
</div>
<h3><span style="font-family: "Microsoft YaHei"; font-size: 18px">1.4 修改区域配置文件</span></h3>
<div class="cnblogs_Highlighter">
<pre class="brush:bash;gutter:true;">注意:一旦启用view，所有的zone必须都在view下，所以要把系统默认的自检用的zone也放在view下或者删除
vim /etc/ named. rfc1912. zones
view "lan" { #定义内网view，view代表容器分割
match-clients { 192.168.80.0/24; } ; #匹配内网网段
zone "benet. com" IN.{ #设置要解析的区域
type master;
file "benet. com. zone. lan"; #数据配置文件
};
zone "."IN { #可将根域配置从主配置文件剪切过来，dd+p
type hint ; #hint是根区域类型
file "named.ca"; .
};
};
view "wan" { #定义外网view
match-clients { any; } ; #匹配除了内网网段以外的任意地址
zone "benet. com" IN {
type master;
file "benet . com. zone. wan";
};
};
</pre>
</div>
<h3><span style="font-family: "Microsoft YaHei"; font-size: 18px">1.5 修改区域数据配置文件 </span></h3>
<div class="cnblogs_Highlighter">
<pre class="brush:bash;gutter:true;">cd /var/ named
cp -p named. localhost benet. com. zone. lan
cp -P named. localhost benet. com. zone. wan
vim benet. com. zone.lan
$TTL 1D
@ IN SOA benet. com. admin. benet. com. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ); minimum
NS benet. com.
A 192.168.80.10
www IN A 192.168.80.10 #内网主机通过解析www.benet.com的地址得到192.168.80.10（想要访问
域名服务的Apache网页，需要开启httpd服务，解析的ip要和域名服务器一致）
cp -P named. localhost benet. com. zone. wan .
vim benet. com. zone.lan
$TTL 1D
@ IN SOA benet. com. admin. benet. com. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ); minimum
NS benet. com.
A 12.0.0.1
www IN A 12.0.0.100 #内网主机通过解析www.benet.com的地址得到192.168.80.100
</pre>
</div>
<h3><span style="font-family: "Microsoft YaHei"; font-size: 18px">1.6 关闭防火墙、安全防护功能，然后启动named服务</span></h3>
<div class="cnblogs_Highlighter">
<pre class="brush:bash;gutter:true;">systemctl stop firewall #关闭防火墙
setenforce 0 #关闭安全防护功能
systemctl restart named #重启服务
</pre>
</div>
<h3><span style="font-family: "Microsoft YaHei"; font-size: 18px">1.7 在内外网客户端的域名解析配置文件中添加DNS服务器地址</span></h3>
<div class="cnblogs_Highlighter">
<pre class="brush:bash;gutter:true;">echo "nameserver 192.168.80.10" >> /etc/resolv.conf #内网客户端
echo "nameserver 192.168.80.10" >> /etc/resolv.conf #外网客户端
</pre>
</div>
<h3><span style="font-family: "Microsoft YaHei"; font-size: 18px">1.8 在内外网客户端上测试</span></h3>
<div class="cnblogs_Highlighter">
<pre class="brush:bash;gutter:true;">nulookip www.clj.com #解析域名测试
nulookip 192.168.80.10 #解析ip测试
</pre>
</div>
<h1>四、实例操作二：DNS分离解析</h1>
<p><span style="font-family: "Microsoft YaHei"; font-size: 18px; background-color: rgba(0, 255, 255, 1)">分离解析：centos7-3 为网关服务器（添加网卡），centos7-2为web服务器和内网客户端，win10为外网客户端</span></p>
<h2><span style="font-family: "Microsoft YaHei"; font-size: 18px">1.为网关服务器配置双网卡</span></h2>
<p><span style="font-family: "Microsoft YaHei"; font-size: 18px">虚拟机中添加另一块网络适配器（网卡）</span></p>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701121445928-1715146802.png" alt="" loading="lazy"> </p>
<p> </p>
<p> <img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701121455843-685402172.png" alt="" loading="lazy"> </p>
<h2>2、在自己电脑上（宿主机）中的VMnet1和VMnet2的配置如下：（在连接不到xshell的时候需要设置）</h2>
<p> <img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701122350326-2080580465.png" alt="" loading="lazy"> </p>
<p> <img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701122358827-1271222055.png" alt="" loading="lazy"> </p>
<h2>3.使用ifconfig进行查看网卡是否配置成功，并设置网卡</h2>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701130137085-1723481623.png" alt="" loading="lazy"></p>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701130144976-2137760289.png" alt="" loading="lazy"></p>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701130152610-301707046.png" alt="" loading="lazy"></p>
<h2>4、安装bind软件包（安装不成功时，需要建立本地YUM源仓库之后才能安装）</h2>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701130600440-314078532.png" alt="" loading="lazy"></p>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701130608589-1572737460.png" alt="" loading="lazy"></p>
<h2>5、修改主配置文件</h2>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701131010070-51781981.png" alt="" loading="lazy"></p>
<h2>6、修改区域配置文件（一旦启用view，所有的zone必须在view下，可注释或删除多余的！！）</h2>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701131638169-2091806546.png" alt="" loading="lazy"></p>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701131646653-550507564.png" alt="" loading="lazy"></p>
<h2>7、修改区域数据配置文件（复制区域数据配置文件，并修改复制的文件）</h2>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701132021374-955917672.png" alt="" loading="lazy"></p>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701132614327-1733843125.png" alt="" loading="lazy"></p>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701132622248-1376804444.png" alt="" loading="lazy"></p>
<h2>8、启动服务、关闭防火墙等，然后进行解析测试。</h2>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701133245867-1775594318.png" alt="" loading="lazy"></p>
<h2>9.在内网客户端进行测试，即打开另一台centos7-2主机作为内网客户端进行测试</h2>
<h3><span style="font-family: "Microsoft YaHei"; font-size: 18px">9.1 虚拟机centos7-2要设置网络适配器</span></h3>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701133653022-446373711.png" alt="" loading="lazy"></p>
<h3><span style="font-family: "Microsoft YaHei"; font-size: 18px">9.2 在此虚拟机上要安装bind(安装步骤不再赘述，可参照网关服务器的bind安装)，进行解析测试</span></h3>
<p> <img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701143136904-328938569.png" alt="" loading="lazy"></p>
<h2>10、在外网客户端测试，开启win10虚拟机作为外网测试</h2>
<h3><span style="font-family: "Microsoft YaHei"; font-size: 18px">10.1 win10要设置网络适配器（因为是外网，所以要设置VMnet2仅主机模式）</span></h3>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701143631422-1889664145.png" alt="" loading="lazy"></p>
<h3><span style="font-family: "Microsoft YaHei"; font-size: 18px">10.2 打开CDM命令提示符进行DNS解析测试</span></h3>
<p><img src="https://img2020.cnblogs.com/blog/2389735/202107/2389735-20210701143901314-299366305.png" alt="" loading="lazy"></p>
<p> </p>
<h2><span style="font-family: "Microsoft YaHei"; font-size: 18px">11、总结：</span></h2>
<p><span style="font-family: "Microsoft YaHei"; font-size: 18px">1、分离解析时，要划分好网关服务器、内网客户端、外网客户端</span></p>
<p><span style="font-family: "Microsoft YaHei"; font-size: 18px">2、在修改区域配置文件时，使用view的时候别忘记清空多余的内容，并回到主配置文件记得把zone的部分注释或者删除</span></p>
<p><span style="font-family: "Microsoft YaHei"; font-size: 18px">3、内网和外网客户端测试时，要修改网络适配器，并跟网关服务器的内外网网卡属性保持一致</span></p>
</div>
<div id="MySignature" role="contentinfo">
将本人在工作学习中的一些知识记录并分享<br><br>
来源：https://www.cnblogs.com/weq0805/p/14956114.html
頁:
[1]