RHEL6 DNS Server 配置

cheng029

1.安装DNS Server
[iyunv@akinlau /]#yum -y install bind*
bind-utils-9.7.0-5.P2.el6.x86_64 bind-libs-9.7.0-5.P2.el6.x86_64
bind-9.7.0-5.P2.el6_0.1.x86_64
2.启动named服务
[iyunv@akinlau /]#service named start
3.设置开机启动named服务
[iyunv@akinlau /]#chkconfig --level 235 named on
4修改配置文件named.conf，以下红色字体的内容为修改过的，其它保持默认
[iyunv@akinlau /]#vim /etc/named.conf
=====================分隔线=====================
options {
listen-on port 53 { 127.0.0.1; 192.168.1.2; }; #监听本地端口53
listen-on-v6 port 53 { ::1; };
directory  "/var/named";
dump-file  "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query     { localhost; 192.168.1.0/24; }; #接受192.168.1.0/24网段的DNS查询
recursion yes;

dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;

/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
};

logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};

zone "." IN {
type hint;
file "named.ca";
};
#下面添加examaple.com的正向域和反向域解析
zone "example.com" IN {
        type master;
        file "example.com.zone";
        allow-update { none;};
};
zone "1.168.192.in-addr.arpa" IN {
        type master;
        file "192.168.1.zone";
        allow-update {none;};
};

include "/etc/named.rfc1912.zones";
=====================分隔线=====================
5.在/var/named/目录下新建example.com.zone和192.168.1.zone文件，用named.localhost做模板，注意文件名要跟named.conf保持一样
[iyunv@akinlau /]#cp /var/named/named.localhost /var/named/example.com.zone
[iyunv@akinlau /]#cp /var/named/named.localhost /var/named/192.168.1.zone
修改example.com.zone和192.168.1.zone的拥有组，不然会出现status:SERVFAIL的错误
[iyunv@akinlau /]#chown root:named example.com.zone 192.168.1.zone
[iyunv@akinlau /]#vim /var/named/example.com.zone

$ORIGIN example.com.
$TTL 1D
@ IN SOA server.example.com. roo.server.example.com. (
1 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
IN NS server.example.com.
server IN A 192.168.1.2

[iyunv@akinlau /]#vim /var/named/192.168.1.zone


$ORIGIN 1.168.192.in-addr.arpa.
$TTL 1D
@ IN SOA server.example.com. root.server.example.com. (
1 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
IN NS server.example.com.
2 IN PTR server.example.com.

6.修改防火墙配置，让外部可以进行DNS查询,dns 查询小于 512 bytes 走 udp ，大于走 tcp.
[iyunv@akinlau /]#vim /etc/sysconfig/iptables
-A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT

对于 INPUT 请求，只放行目标端口为 53，状态为 NEW 的连接，如 外部机器对本dns server 进行查询时的初次连接。
rhel 防火墙对于状态为 ESTABLISHED,RELATED 的连接通通放行，所以这里不用设置 OUTPUT
[iyunv@akinlau /]# service iptables restart
[iyunv@akinlau /]# service named restart
7.DNS测试
如果你只是在局域网内测试DNS，只要给客户端机器加上新配的 DNS (192.168.1.2)或是在dhcp里指定，然后执行下面的命令：
[iyunv@akinlau /]#dig server.example.com

; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> server.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21929
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;server.example.com. IN A

;; ANSWER SECTION:
server.example.com. 86400 IN A 192.168.1.2

;; AUTHORITY SECTION:
example.com. 86400 IN NS server.example.com.

;; Query time: 2 msec
;; SERVER: 192.168.1.2#53(192.168.1.2)
;; WHEN: Fri Feb 17 12:17:37 2012
;; MSG SIZE  rcvd: 66
如果出现status: NOERROR就证明配置是正确的，如果出现status:SERVFAIL把example.com.zone和192.168.1.zone的拥有组改为named就可解决
再用nslookup命令解析一下，如果可以获得正常IP就OK啦
[iyunv@akinlau /]#nslookup server.example.com
Server: 192.168.1.2
Address: 192.168.1.2#53

Name: server.example.com
Address: 192.168.1.2

13432878738

沙发！沙发!

vincen

找到好贴不容易，我顶你了，谢了

sunfull

如果跟导师讲不清楚，那么就把他搞胡涂吧!

圣凤凌霜

支持一下:lol

q528

站的更高，尿的更远。

samdung

脱了衣服我是禽兽，穿上衣服我是衣冠禽兽!