使用bind在linux上搭建私人DNS并对外开放

妖狐艹你老母 2022-04-13 13:23 92阅读 0赞

## 需求: ##

自己搭建DNS服务器,[把指定域名aa.bb.cc][aa.bb.cc] 映射到ip 1.2.3.4上,并对外提供dns服务

## 系统版本: ##

CentOS Linux release 7.3.1611 (Core)

## 下载软件: ##

yum -y install bind-chroot

主程序 /usr/sbin/named

## 调整配置: ##

需要修改的配置文件如下:  
主配置文件 /etc/named.conf  
区域配置文件 /etc/named.rfc1912.zones

### 主配置文件修改如下: ###

options {
    	listen-on port 53 { any; };
    	listen-on-v6 port 53 { ::1; };
    	directory 	"/var/named";
    	dump-file 	"/var/named/data/cache_dump.db";
    	statistics-file "/var/named/data/named_stats.txt";
    	memstatistics-file "/var/named/data/named_mem_stats.txt";
    	allow-query     { any; };
    
    	/* 
    	 - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
    	 - If you are building a RECURSIVE (caching) DNS server, you need to enable 
    	   recursion. 
    	 - If your recursive DNS server has a public IP address, you MUST enable access 
    	   control to limit queries to your legitimate users. Failing to do so will
    	   cause your server to become part of large scale DNS amplification 
    	   attacks. Implementing BCP38 within your network would greatly
    	   reduce such attack surface 
    	*/
    	recursion yes;
    
    	dnssec-enable yes;
    	dnssec-validation yes;
    
    	/* Path to ISC DLV key */
    	bindkeys-file "/etc/named.iscdlv.key";
    
    	managed-keys-directory "/var/named/dynamic";
    
    	pid-file "/run/named/named.pid";
    	session-keyfile "/run/named/session.key";
    };

127.0.0.1修改为any，代表允许监听任何IP地址;localhost修改为any，代表允许任何主机查询。

### 区域配置文件修改如下: ###

zone "aa.bb.cc" IN {
    	type master;
    	file "aa.bb.cc.zone";
    	allow-update { none; };
    };

### 新增配置文件: ###

在/var/named目录下添加  
文件:  
aa.bb.cc.zone  
内容如下:

$TTL 1D
    @	IN SOA	@ aa.bb.cc. (
    					0	; serial
    					1D	; refresh
    					1H	; retry
    					1W	; expire
    					3H )	; minimum
    
            NS      @
            A       1.2.3.4
            AAAA    ::1

## 启动服务: ##

service named start

## 校验是否成功: ##

电脑设置dns服务器为本机ip,打开cmd输入

ipconfig /flushdns
    nslookup aa.bb.cc

若显示信息为  
1.2.3.4  
则设置DNS成功

[aa.bb.cc]: http://xn--aa-mn6cx8lovfpqm9ya.bb.cc