前往小程序，Get更优阅读体验！
立即前往
文档建议反馈控制台
首页
学习
活动
专区
工具
TVP
最新优惠活动
文章/答案/技术大牛
发布
首页
学习
活动
专区
工具
TVP最新优惠活动
返回腾讯云官网
社区首页 >专栏 >DNS服务器搭建（Linux版本）

DNS服务器搭建（Linux版本）

作者头像
宝耶需努力
发布于 2022-12-13 14:18:57
3.8K0
发布于 2022-12-13 14:18:57
举报
文章被收录于专栏：Cloud-DIY

DNS服务器搭建(使用Linux版本)

参考视频：P2.Linux服务器项目实训-DNS服务器配置（bind的正向解释和反向解释）

参考文章：CentOS下搭建DNS服务器、Linux网络服务——部署搭建DNS服务器

一、安装BIND

代码语言：javascript
复制
[root@server ~]# yum clean all
[root@server ~]# yum repolist
[root@server ~]# yum list | grep '^bind\.'
[root@server ~]# yum -y install bind*

二、配置主配置文件

  • 备份需配置的文件，防止配置当中出错。
代码语言：javascript
复制
[root@server ~]# cp /etc/named.conf /etc/named.conf.backup
image-20210721153620005
image-20210721153620005
  • 配置named.conf主配置文件

主要修改这两处信息。其余信息根据情况自行修改设置。

listen-on port 53 { any; }; allow-query { any; }; 按:wq保存退出

代码语言：javascript
复制
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
        listen-on port 53 { any; };		#允许所有IP地址监听53号端口
        #listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";	
        secroots-file   "/var/named/data/named.secroots";
        allow-query     { any; };	#允许所有使用本解析服务的网段

        /*
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable
           recursion.
         - If your recursive DNS server has a public IP address, you MUST enable access
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.root.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

三、配置区域配置文件。添加正向解析配置。

在末尾添加如下配置。

vim /etc/named.rfc1912.zones zone “xybdns.com” IN { type master; file “xybdns.com.zone”; allow-update { none; }; 按:wq保存退出

代码语言：javascript
复制
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

zone "localhost.localdomain" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};

zone "localhost" IN {
        type master;
        file "named.localhost";
        allow-update { none; };
};

zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

zone "1.0.0.127.in-addr.arpa" IN {
        type master;
        file "named.loopback";
        allow-update { none; };
};

zone "0.in-addr.arpa" IN {
        type master;
        file "named.empty";
        allow-update { none; };
};

zone "xybdns.com" IN {	 #正向解析为“pakho.com”
        type master;	 #类型：主缓存为master
        file "xybdns.com.zone";	#指定区域数据文件为xybdns.com.zone
        allow-update { none; };
};

四、配置正向区域数据文件

  • 拷贝主配置文件，保留源文件的权限和属主的属性复制

cp -a named.localhost xybdns.com.zone

代码语言：javascript
复制
[root@server ~]# cd /var/named/
[root@server named]# cp -a named.localhost xybdns.com.zone
[root@server named]# ll
total 28
drwxr-x--- 7 root  named   61 Jul  9 05:18 chroot
drwxrwx--- 2 named named   49 Jul 20 03:11 data
-rw-r----- 1 root  named  259 Jul 14 03:42 dnsdiy.com.zone
drwxrwx--- 2 named named   31 Jul 20 01:25 dynamic
-rw-r----- 1 root  named 2253 Apr  5  2018 named.ca
-rw-r----- 1 root  named  152 Dec 15  2009 named.empty
-rw-r----- 1 root  named  152 Jun 21  2007 named.localhost
-rw-r----- 1 root  named  168 Dec 15  2009 named.loopback
drwxrwx--- 2 named named    6 Apr 29 10:05 slaves
-rw-r----- 1 root  named  515 Jul 20 04:26 xybdns.com.zone
-rw-r----- 1 root  named  538 Jul 14 03:53 xybdns.com.zone.bakup
  • 配置正向区域数据文件

注意：“.”的书写格式，其代替了@，别遗漏

代码语言：javascript
复制
[root@server named]# vim xybdns.com.zone	#进入配置文件
[root@server named]# cat xybdns.com.zone	#查看配置文件
$TTL 1D	#有效解析记录的生成周期
@       IN SOA  xybdns.com. root.xybdns.com. (
#@表示当前的DNS区域名表示这个域名  SOA表示授权信息开启 后面表示邮件地址因为@有特殊含义 所以使用.代替 
                                        0       ; serial	#更新序列号，可以是10以内的整数
                                        1D      ; refresh	#刷新时间，重新下载地址数据的间隔
                                        1H      ; retry		#重试延迟，下载失败后的重试延迟
                                        1W      ; expire #失效时间，超过该时间仍无法下载则放弃
                                        3H )    ; minimum	#无效解析记录的生存周期
        IN      NS      server.xybdns.com.	#记录当前区域DNS服务器的名称
        IN      MX 10   server.xybdns.com.	#MX为邮件服务器 10表示优先级 数字越大优先级越低
server  IN      A       192.168.200.115		#记录正向解析域名对应的IP，即将域名与IP绑捆
web     IN      A       192.168.200.115
vsan7   IN      A       192.168.200.118
  • 修改主机名
代码语言：javascript
复制
[root@server ~]# hostnamectl set-hostname server.xybdns.com
[root@server ~]# bash
[root@server ~]# hostname
server.xybdns.com
  • 配置文件语法检查工具

named-checkconf -z /etc/named.conf

仅检查语法不检查逻辑关系。当显示的全为0时表示没有语法错误

代码语言：javascript
复制
[root@server ~]# named-checkconf -z /etc/named.conf
zone localhost.localdomain/IN: loaded serial 0
zone localhost/IN: loaded serial 0
zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0
zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0
zone 0.in-addr.arpa/IN: loaded serial 0
zone xybdns.com/IN: loaded serial 0

五、启动DNS服务

  • 启动前，检查防火墙、SELINUX安全模式是否是关闭或允许状态

关闭防火墙并设置开机不自启动防火墙

代码语言：javascript
复制
[root@server ~]# systemctl stop firewalld && systemctl disable firewalld
[root@server ~]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: inactive (dead)
     Docs: man:firewalld(1)

关闭SELINUX安全模式

代码语言：javascript
复制
[root@server ~]# cat /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=disabled	#修改为disabled保存退出
# SELINUXTYPE= can take one of three values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected.
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted
[root@server ~]# getenforce	#重启生效
Disabled
  • 启动dns服务

systemctl start named systemctl enable named

代码语言：javascript
复制
[root@server ~]# systemctl start named
[root@server ~]# systemctl enable named
[root@server ~]# systemctl status named
image-20210721162146821
image-20210721162146821
  • 查看53号监听端口是否开启

若执行不了netstat命令，请先输入yum install -y net-tools命令安装net-tools工具 netstat -anpt | grep 53

代码语言：javascript
复制
[root@server ~]# netstat -anpt | grep 53
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      2416/named
tcp        0      0 192.168.200.115:53      0.0.0.0:*               LISTEN      2416/named
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      2416/named
tcp6       0      0 ::1:953                 :::*                    LISTEN      2416/named

六、测试DNS服务器

  • 在Windows 10环境下测试

设置所在网络配置，添加DNS服务器地址、默认网关等信息。如图所示。

image-20210721162953049
image-20210721162953049
image-20210721163117302
image-20210721163117302
image-20210721163404324
image-20210721163404324
  • 在linux环境下测试

设置dns DNS=192.168.200.115 按:wq保存退出

代码语言：javascript
复制
[root@test ~]# cat /etc/sysconfig/network-scripts/ifcfg-ens32
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=static
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
NAME=ens32
UUID=db4e154b-6cc7-420c-a43c-e5a27af7749d
DEVICE=ens32
ONBOOT=yes
IPADDR=192.168.200.120
NETMASK=255.255.255.0
GATEWAY=192.168.200.1
DNS=192.168.200.115

安装nslookup yum provides nslookup yum install -y bind-utils

代码语言：javascript
复制
[root@test ~]# yum provides nslookup
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
32:bind-utils-9.11.4-9.P2.el7.x86_64 : Utilities for querying DNS name servers
Repo        : centos
Matched from:
Filename    : /usr/bin/nslookup



32:bind-utils-9.11.4-9.P2.el7.x86_64 : Utilities for querying DNS name servers
Repo        : @centos
Matched from:
Filename    : /usr/bin/nslookup
[root@test ~]# yum install -y bind-utils
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
Package 32:bind-utils-9.11.4-9.P2.el7.x86_64 already installed and latest version
Nothing to do
代码语言：javascript
复制
[root@test ~]# ping baidu.com
PING baidu.com (220.181.38.148) 56(84) bytes of data.
64 bytes from 220.181.38.148 (220.181.38.148): icmp_seq=1 ttl=128 time=45.0 ms
^C
--- baidu.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 45.080/45.080/45.080/0.000 ms
[root@test ~]# ping server.xybdns.com
PING server.xybdns.com (192.168.200.115) 56(84) bytes of data.
64 bytes from 192.168.200.115 (192.168.200.115): icmp_seq=1 ttl=64 time=0.148 ms
64 bytes from 192.168.200.115 (192.168.200.115): icmp_seq=2 ttl=64 time=0.330 ms
^C
--- server.xybdns.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 0.148/0.239/0.330/0.091 ms
[root@test ~]# nslookup www.baidu.com
Server:         192.168.200.115
Address:        192.168.200.115#53

Non-authoritative answer:
www.baidu.com   canonical name = www.a.shifen.com.
Name:   www.a.shifen.com
Address: 180.101.49.11
Name:   www.a.shifen.com
Address: 180.101.49.12

[root@test ~]# nslookup server.xybdns.com
Server:         192.168.200.115
Address:        192.168.200.115#53

Name:   server.xybdns.com
Address: 192.168.200.115
本文参与 腾讯云自媒体同步曝光计划，分享自作者个人站点/博客。
原始发表：2021-07-22，如有侵权请联系 cloudcommunity@tencent.com 删除
yum
linux
防火墙
网络安全
dns

本文分享自 作者个人站点/博客 前往查看

如有侵权，请联系 cloudcommunity@tencent.com 删除。

本文参与 腾讯云自媒体同步曝光计划  ，欢迎热爱写作的你一起参与！

yum
linux
防火墙
网络安全
dns
评论
登录后参与评论
0 条评论
热度
最新
登录 后参与评论
推荐阅读
LV.
文章
0
获赞
0
目录
  • DNS服务器搭建(使用Linux版本)
    • 一、安装BIND
      • 二、配置主配置文件
        • 三、配置区域配置文件。添加正向解析配置。
          • 四、配置正向区域数据文件
            • 五、启动DNS服务
              • 六、测试DNS服务器
              领券

              腾讯云开发者

              扫码关注腾讯云开发者

              扫码关注腾讯云开发者

              领取腾讯云代金券

              热门产品

              热门推荐

              更多推荐

              Copyright © 2013 - 2024 Tencent Cloud. All Rights Reserved. 腾讯云 版权所有 

              深圳市腾讯计算机系统有限公司 ICP备案/许可证号：粤B2-20090059 深公网安备号 44030502008569

              腾讯云计算（北京）有限责任公司 京ICP证150476号 |  京ICP备11018762号 | 京公网安备号11010802020287

              问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档

              Copyright © 2013 - 2024 Tencent Cloud.

              All Rights Reserved. 腾讯云 版权所有

              登录 后参与评论