【Linux】CentOS+UOS的Bind9内外网解析配置
功能需求
内网客户端请求时，解析到服务器的内网地址
公网客户端解析时，解析到提供服务的公网地址
基本拓扑
注：主机之间路由可达，且路由上需配置NAT，使两台服务器可互相访问公网地址互联
安装服务
在两台服务器上安装bind9:
[root@CentOS ~]# yum install bind -y
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
Resolving Dependencies
--> Running transaction check
---> Package bind.x86_64 32:9.11.4-26.P2.el7 will be installed
--> Processing Dependency: bind-libs-lite(x86-64) = 32:9.11.4-26.P2.el7 for package: 32:bind-9.11.4-26.P2.el7.x86_64
--> Processing Dependency: bind-libs(x86-64) = 32:9.11.4-26.P2.el7 for package: 32:bind-9.11.4-26.P2.el7.x86_64
--> Processing Dependency: python-ply for package: 32:bind-9.11.4-26.P2.el7.x86_64
--> Processing Dependency: policycoreutils-python for package: 32:bind-9.11.4-26.P2.el7.x86_64
--> Processing Dependency: policycoreutils-python for package: 32:bind-9.11.4-26.P2.el7.x86_64
--> Processing Dependency: liblwres.so.160()(64bit) for package: 32:bind-9.11.4-26.P2.el7.x86_64
--> Processing Dependency: libisccfg.so.160()(64bit) for package: 32:bind-9.11.4-26.P2.el7.x86_64
--> Processing Dependency: libisccc.so.160()(64bit) for package: 32:bind-9.11.4-26.P2.el7.x86_64
--> Processing Dependency: libisc.so.169()(64bit) for package: 32:bind-9.11.4-26.P2.el7.x86_64
--> Processing Dependency: libdns.so.1102()(64bit) for package: 32:bind-9.11.4-26.P2.el7.x86_64
--> Processing Dependency: libbind9.so.160()(64bit) for package: 32:bind-9.11.4-26.P2.el7.x86_64
--> Processing Dependency: libGeoIP.so.1()(64bit) for package: 32:bind-9.11.4-26.P2.el7.x86_64
--> Running transaction check
---> Package GeoIP.x86_64 0:1.5.0-14.el7 will be installed
--> Processing Dependency: geoipupdate for package: GeoIP-1.5.0-14.el7.x86_64
---> Package bind-libs.x86_64 32:9.11.4-26.P2.el7 will be installed
--> Processing Dependency: bind-license = 32:9.11.4-26.P2.el7 for package: 32:bind-libs-9.11.4-26.P2.el7.x86_64
---> Package bind-libs-lite.x86_64 32:9.11.4-26.P2.el7 will be installed
---> Package policycoreutils-python.x86_64 0:2.5-34.el7 will be installed
--> Processing Dependency: setools-libs >= 3.3.8-4 for package: policycoreutils-python-2.5-34.el7.x86_64
--> Processing Dependency: libsemanage-python >= 2.5-14 for package: policycoreutils-python-2.5-34.el7.x86_64
--> Processing Dependency: audit-libs-python >= 2.1.3-4 for package: policycoreutils-python-2.5-34.el7.x86_64
--> Processing Dependency: python-IPy for package: policycoreutils-python-2.5-34.el7.x86_64
--> Processing Dependency: libqpol.so.1(VERS_1.4)(64bit) for package: policycoreutils-python-2.5-34.el7.x86_64
--> Processing Dependency: libqpol.so.1(VERS_1.2)(64bit) for package: policycoreutils-python-2.5-34.el7.x86_64
--> Processing Dependency: libcgroup for package: policycoreutils-python-2.5-34.el7.x86_64
--> Processing Dependency: libapol.so.4(VERS_4.0)(64bit) for package: policycoreutils-python-2.5-34.el7.x86_64
--> Processing Dependency: checkpolicy for package: policycoreutils-python-2.5-34.el7.x86_64
--> Processing Dependency: libqpol.so.1()(64bit) for package: policycoreutils-python-2.5-34.el7.x86_64
--> Processing Dependency: libapol.so.4()(64bit) for package: policycoreutils-python-2.5-34.el7.x86_64
---> Package python-ply.noarch 0:3.4-11.el7 will be installed
--> Running transaction check
---> Package audit-libs-python.x86_64 0:2.8.5-4.el7 will be installed
---> Package bind-license.noarch 32:9.11.4-26.P2.el7 will be installed
---> Package checkpolicy.x86_64 0:2.5-8.el7 will be installed
---> Package geoipupdate.x86_64 0:2.5.0-1.el7 will be installed
---> Package libcgroup.x86_64 0:0.41-21.el7 will be installed
---> Package libsemanage-python.x86_64 0:2.5-14.el7 will be installed
---> Package python-IPy.noarch 0:0.75-6.el7 will be installed
---> Package setools-libs.x86_64 0:3.3.8-4.el7 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
============================================================================================================================================================================================
Package Arch Version Repository Size
============================================================================================================================================================================================
Installing:
bind x86_64 32:9.11.4-26.P2.el7 c7-media 2.3 M
Installing for dependencies:
GeoIP x86_64 1.5.0-14.el7 c7-media 1.5 M
audit-libs-python x86_64 2.8.5-4.el7 c7-media 76 k
bind-libs x86_64 32:9.11.4-26.P2.el7 c7-media 156 k
bind-libs-lite x86_64 32:9.11.4-26.P2.el7 c7-media 1.1 M
bind-license noarch 32:9.11.4-26.P2.el7 c7-media 90 k
checkpolicy x86_64 2.5-8.el7 c7-media 295 k
geoipupdate x86_64 2.5.0-1.el7 c7-media 35 k
libcgroup x86_64 0.41-21.el7 c7-media 66 k
libsemanage-python x86_64 2.5-14.el7 c7-media 113 k
policycoreutils-python x86_64 2.5-34.el7 c7-media 457 k
python-IPy noarch 0.75-6.el7 c7-media 32 k
python-ply noarch 3.4-11.el7 c7-media 123 k
setools-libs x86_64 3.3.8-4.el7 c7-media 620 k
Transaction Summary
============================================================================================================================================================================================
Install 1 Package (+13 Dependent packages)
Total download size: 6.9 M
Installed size: 18 M
Downloading packages:
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total 9.2 MB/s | 6.9 MB 00:00:00
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : 32:bind-license-9.11.4-26.P2.el7.noarch 1/14
Installing : setools-libs-3.3.8-4.el7.x86_64 2/14
Installing : audit-libs-python-2.8.5-4.el7.x86_64 3/14
Installing : libcgroup-0.41-21.el7.x86_64 4/14
Installing : checkpolicy-2.5-8.el7.x86_64 5/14
Installing : python-IPy-0.75-6.el7.noarch 6/14
Installing : libsemanage-python-2.5-14.el7.x86_64 7/14
Installing : policycoreutils-python-2.5-34.el7.x86_64 8/14
Installing : geoipupdate-2.5.0-1.el7.x86_64 9/14
Installing : GeoIP-1.5.0-14.el7.x86_64 10/14
Installing : 32:bind-libs-lite-9.11.4-26.P2.el7.x86_64 11/14
Installing : 32:bind-libs-9.11.4-26.P2.el7.x86_64 12/14
Installing : python-ply-3.4-11.el7.noarch 13/14
Installing : 32:bind-9.11.4-26.P2.el7.x86_64 14/14
Verifying : 32:bind-libs-9.11.4-26.P2.el7.x86_64 1/14
Verifying : GeoIP-1.5.0-14.el7.x86_64 2/14
Verifying : python-ply-3.4-11.el7.noarch 3/14
Verifying : geoipupdate-2.5.0-1.el7.x86_64 4/14
Verifying : 32:bind-license-9.11.4-26.P2.el7.noarch 5/14
Verifying : libsemanage-python-2.5-14.el7.x86_64 6/14
Verifying : python-IPy-0.75-6.el7.noarch 7/14
Verifying : checkpolicy-2.5-8.el7.x86_64 8/14
Verifying : policycoreutils-python-2.5-34.el7.x86_64 9/14
Verifying : 32:bind-9.11.4-26.P2.el7.x86_64 10/14
Verifying : libcgroup-0.41-21.el7.x86_64 11/14
Verifying : audit-libs-python-2.8.5-4.el7.x86_64 12/14
Verifying : 32:bind-libs-lite-9.11.4-26.P2.el7.x86_64 13/14
Verifying : setools-libs-3.3.8-4.el7.x86_64 14/14
Installed:
bind.x86_64 32:9.11.4-26.P2.el7
Dependency Installed:
GeoIP.x86_64 0:1.5.0-14.el7 audit-libs-python.x86_64 0:2.8.5-4.el7 bind-libs.x86_64 32:9.11.4-26.P2.el7 bind-libs-lite.x86_64 32:9.11.4-26.P2.el7
bind-license.noarch 32:9.11.4-26.P2.el7 checkpolicy.x86_64 0:2.5-8.el7 geoipupdate.x86_64 0:2.5.0-1.el7 libcgroup.x86_64 0:0.41-21.el7
libsemanage-python.x86_64 0:2.5-14.el7 policycoreutils-python.x86_64 0:2.5-34.el7 python-IPy.noarch 0:0.75-6.el7 python-ply.noarch 0:3.4-11.el7
setools-libs.x86_64 0:3.3.8-4.el7
Complete!
[root@CentOS ~]# root@UOS:~# apt install bind9 -y
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
cracklib-runtime dde-account-faces dde-qt5integration dde-qt5integration5 dde-qt5integration5.5 dde-qt5xcb-plugin deepin-installer-timezones deepin-pw-check fbterm imageworsener
libc-ares2 libcrack2 libdeepin-pw-check libdtkcore5.5 libdtkgui5.5 libdtkwidget5.5 libheif1 libindicator3-7 libiniparser1 liblqr-1-0 libmaxminddb0 libqt5xdg3 libqt5xdgiconloader3
libqtermwidget5-0 libsmi2ldbl libutf8proc2 libwireshark-data libwireshark11 libwiretap8 libwscodecs2 libwsutil9 libx86-1 libxcb-composite0 libxcb-damage0 libxklavier16 mtools
qtermwidget5-data squashfs-tools
Use 'apt autoremove' to remove them.
The following additional packages will be installed:
bind9utils dns-root-data python3-ply
Suggested packages:
bind9-doc resolvconf ufw python-ply-doc python3-pkg-resources
The following NEW packages will be installed:
bind9 bind9utils dns-root-data python3-ply
0 upgraded, 4 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/1,128 kB of archives.
After this operation, 4,096 kB of additional disk space will be used.
Get:1 file:/mnt fou/main amd64 python3-ply all 3.11-3 [65.2 kB]
Get:2 file:/mnt fou/main amd64 bind9utils amd64 1:9.11.5.P4+dfsg.5-5.1+deb10u5 [431 kB]
Get:3 file:/mnt fou/main amd64 dns-root-data all 2019031302 [5,396 B]
Get:4 file:/mnt fou/main amd64 bind9 amd64 1:9.11.5.P4+dfsg.5-5.1+deb10u5 [626 kB]
Preconfiguring packages ...
Selecting previously unselected package python3-ply.
(Reading database ... 90906 files and directories currently installed.)
Preparing to unpack .../ply/python3-ply_3.11-3_all.deb ...
Unpacking python3-ply (3.11-3) ...
Selecting previously unselected package bind9utils.
Preparing to unpack .../bind9utils_9.11.5.P4+dfsg.5-5.1+deb10u5_amd64.deb ...
Unpacking bind9utils (1:9.11.5.P4+dfsg.5-5.1+deb10u5) ...
Selecting previously unselected package dns-root-data.
Preparing to unpack .../dns-root-data_2019031302_all.deb ...
Unpacking dns-root-data (2019031302) ...
Selecting previously unselected package bind9.
Preparing to unpack .../bind9_9.11.5.P4+dfsg.5-5.1+deb10u5_amd64.deb ...
Unpacking bind9 (1:9.11.5.P4+dfsg.5-5.1+deb10u5) ...
Setting up python3-ply (3.11-3) ...
Setting up dns-root-data (2019031302) ...
Setting up bind9utils (1:9.11.5.P4+dfsg.5-5.1+deb10u5) ...
Setting up bind9 (1:9.11.5.P4+dfsg.5-5.1+deb10u5) ...
Adding group `bind' (GID 113) ...
Done.
Adding system user `bind' (UID 106) ...
Adding new user `bind' (UID 106) with group `bind' ...
Not creating home directory `/var/cache/bind'.
wrote key file "/etc/bind/rndc.key"
Created symlink /etc/systemd/system/multi-user.target.wants/bind9.service → /lib/systemd/system/bind9.service.
bind9-pkcs11.service is a disabled or a static unit, not starting it.
bind9-resolvconf.service is a disabled or a static unit, not starting it.
Processing triggers for man-db (2.8.5-2) ...
Processing triggers for systemd (241.17-1+dde) ...
root@UOS:~# CentOS配置要求
为chinaskills.cn 域提供域名解析；
为www.chinaskills.cn、download.chinaskills.cn 和 mail.chinaskills.cn 提供解析；
启用内外网解析功能，当内网客户端请求解析的时候，解析到对应的内部服务器地址，当外部客户端请求解析的时候，请把解析结果解析 到提供服务的公有地址；
请将UOS作为上游DNS服务器，所有未知查询都由该服务器处理。
CentOS服务器配置
修改CentOS的bind配置文件
1 //
2 // named.conf
3 //
4 // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
5 // server as a caching only nameserver (as a localhost DNS resolver only).
6 //
7 // See /usr/share/doc/bind*/sample/ for example named configuration files.
8 //
9 // See the BIND Administrator's Reference Manual (ARM) for details about the
10 // configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html
11
12 options {
13 listen-on port 53 { any; };
#修改监听任意地址
14 listen-on-v6 port 53 { ::1; };
15 directory "/var/named";
16 dump-file "/var/named/data/cache_dump.db";
17 statistics-file "/var/named/data/named_stats.txt";
18 memstatistics-file "/var/named/data/named_mem_stats.txt";
19 recursing-file "/var/named/data/named.recursing";
20 secroots-file "/var/named/data/named.secroots";
21 allow-query { any; };
#修改允许任何主机查询
22 forwarders { 192.168.100.254; };
#指定转发器
23
24 /*
25 - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
26 - If you are building a RECURSIVE (caching) DNS server, you need to enable
27 recursion.
28 - If your recursive DNS server has a public IP address, you MUST enable access
29 control to limit queries to your legitimate users. Failing to do so will
30 cause your server to become part of large scale DNS amplification
31 attacks. Implementing BCP38 within your network would greatly
32 reduce such attack surface
33 */
34 recursion yes;
35
36 dnssec-enable yes;
37 dnssec-validation yes;
38
39 /* Path to ISC DLV key */
40 bindkeys-file "/etc/named.root.key";
41
42 managed-keys-directory "/var/named/dynamic";
43
44 pid-file "/run/named/named.pid";
45 session-keyfile "/run/named/session.key";
46 };
47
48 logging {
49 channel default_debug {
50 file "data/named.run";
51 severity dynamic;
52 };
53 };
54
55 acl LAN {
56 127.0.0.0/8;
57 192.168.0.0/16;
58 };
#创建ACL，匹配内网客户端网段
59
60 view LANDNS {
#创建内网VIEW
61 match-clients { LAN; };
#匹配上面的ACL，使用下面的配置
62 recursion yes;
63
64 zone "." IN {
65 type hint;
66 file "named.ca";
67 };
68
69
70 include "/etc/named.rfc1912.zones";
71 include "/etc/named.root.key";
72 include "/etc/named.lan.zones";
#在新文件中创建内网客户端使用的区域
73 };
#内网VIEW结束
74
75 view WANDNS {
#创建公网VIEW
76 match-clients { any; };
#匹配除内网的其他地址，bind配置文件从第一行到最后一行执行，内网ACL匹配失败才会匹配到这里
77 recursion no;
78 include "/etc/named.wan.zones";
#在新文件中创建外网客户端使用的区域
79 };创建内网区域配置文件
vi /etc/named.lan.zones
zone "chinaskills.cn" IN {
type master;
file "chinaskills.zone";
allow-update { 192.168.100.254; };
};
zone "100.168.192.in-addr.arpa" IN {
type master;
file "192.168.100.zone";
allow-update { none; };
};创建公网区域配置文件
vi named.wan.zones
zone "chinaskills.cn" IN {
type master;
file "chinaskills.wan.zone";
allow-update { 192.168.100.254; };
};创建区域文件
vi chinaskills.zone
$TTL 1D
@ IN SOA @ rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS @
A 127.0.0.1
www A 192.168.100.100
download A 192.168.100.100
mail A 192.168.100.100
* A 81.6.63.100
chinaskills.cn. MX 10 mail.chinaskills.cn. vi 192.168.100.zone
$TTL 1D
@ IN SOA @ rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS @
A 127.0.0.1
100 PTR www.chinaskills.cn.
100 PTR download.chinaskills.cn.
100 PTR mail.chinaskills.cn.vi chinaskills.wan.zone
$TTL 1D
@ IN SOA @ rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS @
A 127.0.0.1
www A 81.6.63.254
download A 81.6.63.254
mail A 81.6.63.254
* A 81.6.63.100
chinaskills.cn. MX 10 mail.chinaskills.cn.检查配置文件是否有错误
重启named服务
检测基本DNS功能
UOS配置要求
配置为DNS根域服务器；
其他未知域名解析,统一解析为该本机IP；
创建正向区域“chinaskills.cn”；
类型为Slave；
主服务器为“CentOS”；
UOS服务器配置
修改UOS的bind配置文件
vi named.conf.options
options {
directory "/var/cache/bind";
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
// forwarders {
// 0.0.0.0;
// };
//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys. See https://www.isc.org/bind-keys
//========================================================================
dnssec-validation auto;
listen-on-v6 { any; };
listen-on port 53 { any; };
#修改监听任意地址
allow-query { any; };
#修改允许任何主机查询
};vi named.conf
// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.lan.view";
#定义内网VIEW
include "/etc/bind/named.conf.wan.view";
#定义公网VIEW创建内网VIEW配置文件
vi named.conf.lan.view
acl LAN {
127.0.0.0/8;
192.168.0.0/16;
};
view LANDNS {
match-clients { LAN; };
recursion yes;
include "/etc/bind/named.conf.default-zones";
include "/etc/bind/named.conf.lan.zones";
};创建内网区域配置文件
vi named.conf.lan.zones
zone "chinaskills.cn" {
type slave;
file "/etc/bind/chinaskills.zone";
masters "81.6.63.254"
};
zone "." {
type master;
file "/etc/bind/root.zone";
};创建公网配置文件
vi named.conf.wan.view
view WANDNS {
match-clients { any; };
recursion no;
include "/etc/bind/named.conf.wan.zones";
};创建公网区域配置文件
vi named.conf.wan.zones
zone "chinaskills.cn" {
type slave;
file "/etc/bind/chinaskills.wan.zone";
masters "81.6.63.254"
};
zone "." {
type master;
file "/etc/bind/root.zone";
};创建区域文件
vi chinaskills.zone
$TTL 1D
@ IN SOA @ rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS @
A 127.0.0.1
www A 192.168.100.100
download A 192.168.100.100
mail A 192.168.100.100
* A 81.6.63.100
chinaskills.cn. MX 10 mail.chinaskills.cn.vi chinaskills.wan.zone
$TTL 1D
@ IN SOA @ rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS @
A 127.0.0.1
www A 81.6.63.254
download A 81.6.63.254
mail A 81.6.63.254
* A 81.6.63.100
chinaskills.cn. MX 10 mail.chinaskills.cn.vi root.zone
$TTL 1D
@ IN SOA @ rname.invalid. (
2 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS @
A 127.0.0.1
. NS ispsrv
ispsrv A 81.6.63.100检测配置文件是否有错误
重启bind9服务
检测基本DNS功能
进行测试
内网
公网
