全部博文（272）
分类： LINUX
2009-09-24 09:59:53
如何在内网的环境下实习DNS服务器呢？经过1个多星期的时间，终于探索出了DNS配置的方式方法。先分析网络架构和域名安排，再遵照指定的步骤，定能配好！
我的外网IP是10.10.23.144，属于校园网。内网IP是192.168.0.1，兼做网关，是centos5的双网卡系统。web服务器是192.168.0.2，DNS服务器是192.168.0.1，当然别的服务还可以再在别的IP机器上配置，就如法炮制即可。
需要安装的rpm包有：bind-util-9.3.4、bind-9.3.4、bind-libs-9.3.4、bind-chroot-9.3.4，然后为了快速配置，安装caching-nameserver包，这样就可以省去很多自建文件的麻烦事。安装完毕后，采用了chroot监牢机制，非常安全。这时必须注意：配置文件的实际目录是/var/named/chroot/，虚拟目录如果是/etc，则真实目录是/var/named/chroot/etc。但只有两个目录是常用的，一个是/etc，一个是/var，/etc下放named.conf，剩下的文件放在/var中。
1、named.conf中的内容：
//
// Sample named.conf BIND DNS server 'named' configuration file
// for the Red Hat BIND distribution.
//
// See the BIND Administrator's Reference Manual (ARM) for details, in:
// file:///usr/share/doc/bind-*/arm/Bv9ARM.html
// Also see the BIND Configuration GUI : /usr/bin/system-config-bind and
// its manual.
//
options
{
// Those options should be used carefully because they disable port
// randomization
query-source port 53;
//query-source-v6 port 53;
// Put files that named is allowed to write in the data/ directory:
directory "/var/named"; // the default
dump-file "data/cache_dump.db";
statistics-file "data/named_stats.txt";
memstatistics-file "data/named_mem_stats.txt";
};
logging
{
/* If you want to enable debugging, eg. using the 'rndc trace' command,
* named will try to write the 'named.run' file in the $directory (/var/named).
* By default, SELinux policy does not allow named to modify the /var/named directory,
* so put the default debug log file in data/ :
*/
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
//
// All BIND 9 zones are in a "view", which allow different zones to be served
// to different types of client addresses, and for options to be set for groups
// of zones.
//
// By default, if named.conf contains no "view" clauses, all zones are in the
// "default" view, which matches all clients.
//
// If named.conf contains any "view" clause, then all zones MUST be in a view;
// so it is recommended to start off using views to avoid having to restructure
// your configuration files in the future.
//
view "localhost_resolver"
{
/* This view sets up named to be a localhost resolver ( caching only nameserver ).
* If all you want is a caching-only nameserver, then you need only define this view:
*/
match-clients { localhost;localnets; };
match-destinations { localhost;localnets; };
recursion yes;
# all views must contain the root hints zone:
include "/etc/named.root.hints";
/* these are zones that contain definitions for all the localhost
* names and addresses, as recommended in RFC1912 - these names should
* ONLY be served to localhost clients:
*/
zone "liukai.com" {
type master;
file "liukai.com.db";
};
zone "0.168.192.in-addr.arpa" IN{
type master;
file "liukai.com.db.arpa";
};
include "/etc/named.rfc1912.zones";
};
2、liukai.com.db中的内容：
@ in soa localhost. root 1 3H 15M 1W 1D
ns localhost.
dns IN A 192.168.0.1
www IN A 192.168.0.2
ok IN CNAME www
ko IN CNAME www
3、liukai.com.db.arpa中的内容：
@ in soa localhost. root 1 3H 15M 1W 1D
ns localhost.
2 IN PTR
1 IN PTR dns.liukai.com
4、named.root.hints中的内容：（也放在/var/named/chroot/var/named）; This file holds the information on root name servers needed to
; initialize cache of Internet domain name servers
; (e.g. reference this file in the "cache .
; configuration file of BIND domain name servers).
;
; This file is made available by InterNIC
; under anonymous FTP as
; file /domain/named.root
; on server
; -OR- RS.INTERNIC.NET
;
; last update: Dec 12, 2008
; related version of root zone: 2008121200
;
; formerly NS.INTERNIC.NET
;
. 3600000 IN NS A.ROOT-SERVERS.NET.
A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4
A.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:BA3E::2:30
;
; FORMERLY NS1.ISI.EDU
;
. 3600000 NS B.ROOT-SERVERS.NET.
B.ROOT-SERVERS.NET. 3600000 A 192.228.79.201
;
; FORMERLY C.PSI.NET
;
. 3600000 NS C.ROOT-SERVERS.NET.
C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12
;
; FORMERLY TERP.UMD.EDU
;
. 3600000 NS D.ROOT-SERVERS.NET.
D.ROOT-SERVERS.NET. 3600000 A 128.8.10.90
;
; FORMERLY NS.NASA.GOV
;
. 3600000 NS E.ROOT-SERVERS.NET.
E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10
;
; FORMERLY NS.ISC.ORG
;
. 3600000 NS F.ROOT-SERVERS.NET.
F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241
F.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2F::F
;
; FORMERLY NS.NIC.DDN.MIL
;
. 3600000 NS G.ROOT-SERVERS.NET.
G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4
;
; FORMERLY AOS.ARL.ARMY.MIL
;
. 3600000 NS H.ROOT-SERVERS.NET.
H.ROOT-SERVERS.NET. 3600000 A 128.63.2.53
H.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:1::803F:235
;
; FORMERLY NIC.NORDU.NET
;
. 3600000 NS I.ROOT-SERVERS.NET.
I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17
;
; OPERATED BY VERISIGN, INC.
;
. 3600000 NS J.ROOT-SERVERS.NET.
J.ROOT-SERVERS.NET. 3600000 A 192.58.128.30
J.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:C27::2:30
;
; OPERATED BY RIPE NCC
;
. 3600000 NS K.ROOT-SERVERS.NET.
K.ROOT-SERVERS.NET. 3600000 A 193.0.14.129
K.ROOT-SERVERS.NET. 3600000 AAAA 2001:7FD::1
;
; OPERATED BY ICANN
;
. 3600000 NS L.ROOT-SERVERS.NET.
L.ROOT-SERVERS.NET. 3600000 A 199.7.83.42
L.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:3::42
;
; OPERATED BY WIDE
;
. 3600000 NS M.ROOT-SERVERS.NET.
M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33
M.ROOT-SERVERS.NET. 3600000 AAAA 2001:DC3::35
; End of File
本主机DNS设置主DNS为192.168.0.1，就可以了，但对外网域名解析较慢，可以增加次DNS为210.47.176.1(具体地区的是有区别的，我这是辽宁的)。客户机DNS都设为192.168.0.1就可以了，当然你也可以设置客户机的次DNS为210.47.176.1，这样更稳妥些，不过解析速度不会快的。注意：要想访问内网网址，必须把192.168.0.1设为首选DNS服务器哦。。。
