智能DNS搭建方案

時間 2020-07-30

標籤智能 dns 搭建方案欄目系統網絡简体版

原文原文鏈接

智能DNS搭建方案服務器

智能DNS主要經過用戶源IP來判斷來源，而後根據不一樣的策略解析到不一樣的IP地址來實現。使得用戶能夠就近訪問所需的資源，提升訪問速度，提高用戶感知。dom

智能DNS可經過bind的view功能來實現。ide

BIND的VIEW功能配置以下：工具

軟件版本：bind-9.9.5-P1.tar.gz測試

依賴：gccspa

openssl-0.9.8zb.tar.gz（bind的DNSSEC須要）orm

1. 安裝opensslserver

tar xf openssl-0.9.8zb.tar.gzip

cd openssl-0.9.8zbssl

./config --prefix=/usr/local --openssldir=/usr/local/openssl && make && make install

2. 安裝bind

tar xf bind-9.9.5-P1.tar.gz

cd bind-9.9.5-P1

./configure --prefix=/home/bind --enable-threads --with-openssl=/usr/local/openssl

make && make install

3. 配置bind

因爲要配置view，那麼全部的zone文件都必須放在view裏面，因此作以下配置：註釋掉named.conf中的named.conf.zone和named.rfc1912.zones

vi /home/bind/etc/named.conf

#named.conf file

include "/home/bind/etc/named.conf.options";

include "/home/bind/etc/named.conf.acl";

include "/home/bind/etc/named.conf.controls";

include "/home/bind/etc/named.conf.server";

include "/home/bind/etc/named.conf.key";

include "/home/bind/etc/named.conf.dlz";

include "/home/bind/etc/named.conf.trusted-keys";

include "/home/bind/etc/named.conf.view";

#include "/home/bind/etc/named.conf.zone";

#include "/home/bind/etc/named.rfc1912.zones";

配置view

vi /home/bind/etc/named.conf.view

view "ctc_view_zone" {

match-clients { CTC; };

include "/home/bind/var/named/view_zone/ctc_zone";

};

view "cuc_view_zone" {

match-clients { CUC; };

include "/home/bind/var/named/view_zone/cuc_zone";

};

view "cmc_view_zone" {

match-clients { CMC; };

include "/home/bind/var/named/view_zone/cmc_zone";

};

view "any_view_zone" {

match-clients { any; };

include "/home/bind/var/named/view_zone/any_zone";

};

分別爲電信、聯通、移動配置view，match-clients對應各自的ACL，實現篩選，include對應各自的zone配置文件。最後一條view爲默認的view，view的匹配順序是從上往下的，因此默認的view配置在最後。

配置zone文件

在/home/bind/var/named/view_zone下建立各自對應的zone文件

ls-l /home/bind/var/named/view_zone

total 16

-rw-r--r--. 1 root root 175 Aug 12 17:47 any_zone

-rw-r--r--. 1 root root 175 Aug 13 17:22 cmc_zone

-rw-r--r--. 1 root root 175 Aug 12 17:47 ctc_zone

-rw-r--r--. 1 root root 175 Aug 12 18:18 cuc_zone

vi /home/bind/var/named/view_zone/ctc_zone

zone "." IN {

type hint;

file "/home/bind/var/named/named.ca";

};

zone "test.com" IN {

type master;

file "/home/bind/var/named/ctc/test.com";

allow-update { none; };

};

Vi /home/bind/var/named/view_zone/cuc_zone

zone "." IN {

type hint;

file "/home/bind/var/named/named.ca";

};

zone "test.com" IN {

type master;

file "/home/bind/var/named/cuc/test.com";

allow-update { none; };

};

Vi /home/bind/var/named/view_zone/cmc_zone

zone "." IN {

type hint;

file "/home/bind/var/named/named.ca";

};

zone "test.com" IN {

type master;

file "/home/bind/var/named/cmc/test.com";

allow-update { none; };

};

vi /home/bind/var/named/view_zone/any_zone

zone "." IN {

type hint;

file "/home/bind/var/named/named.ca";

};

zone "test.com" IN {

type master;

file "/home/bind/var/named/any/test.com";

allow-update { none; };

};

在對應的目錄下配置zone數據文件,配置一條A記錄便於測試

vi /home/bind/var/named/ctc/test.com

$TTL 86400

@ IN SOA test.com. root.localhost. (

42 ; serial (d. adams)

3H ; refresh

15M ; retry

1W ; expiry

1D ) ; minimum

IN NS ns

ns IN A 115.182.75.10

www IN A 1.1.1.1

vi /home/bind/var/named/cuc/test.com

$TTL 86400

@ IN SOA test.com. root.localhost. (

42 ; serial (d. adams)

3H ; refresh

15M ; retry

1W ; expiry

1D ) ; minimum

IN NS ns

ns IN A 115.182.75.10

www IN A 2.2.2.2

vi /home/bind/var/named/cmc/test.com

$TTL 86400

@ IN SOA test.com. root.localhost. (

42 ; serial (d. adams)

3H ; refresh

15M ; retry

1W ; expiry

1D ) ; minimum

IN NS ns

ns IN A 115.182.75.10

www IN A 3.3.3.3

vi /home/bind/var/named/any/test.com

$TTL 86400

@ IN SOA test.com. root.localhost. (

42 ; serial (d. adams)

3H ; refresh

15M ; retry

1W ; expiry

1D ) ; minimum

IN NS ns

ns IN A 115.182.75.10

www IN A 4.4.4.4

配置ACL

因爲IP條目數較多，因此另外建立ACL的文件方便管理

首先在named.conf中關聯相應的文件

vi /home/bind/etc/named.conf

#named.conf file

include "/home/bind/etc/named.conf.options";

include "/home/bind/etc/named.conf.acl";

include "/home/bind/etc/named.conf.controls";

include "/home/bind/etc/named.conf.server";

include "/home/bind/etc/named.conf.key";

include "/home/bind/etc/named.conf.dlz";

include "/home/bind/etc/named.conf.trusted-keys";

include "/home/bind/etc/named.conf.view";

#include "/home/bind/etc/named.conf.zone";

#include "/home/bind/etc/named.rfc1912.zones";

include "/home/bind/etc/named.conf.log";

include "/home/bind/etc/ACL/dianxinACL";

include "/home/bind/etc/ACL/yidongACL";

include "/home/bind/etc/ACL/liantongACL";

include "/home/bind/etc/ACL/changkuanACL";

include "/home/bind/etc/ACL/tietongACL";

include "/home/bind/etc/ACL/jiaoyukeyanACL";

每一個文件對應相應的IP地址庫

格式爲：acl 「acl_name」 { xx.xx.xx.xx; }; 以下所示：

vi /home/bind/etc/ACL/yidongACL

acl "CMC" {

36.128.0.0/10;

39.128.0.0/10;

111.0.0.0/10;

112.0.0.0/10;

……

221.176.0.0/13;

223.64.0.0/10;

};

至此bind的view已經配置完成

啓動bind

/home/bind/sbin/named -u root -c /home/bind/etc/named.conf

(最好建立一個bind帳號來啓動，chown -R bind:bind /home/bind)

ps –ef | grep named 查看服務是否啓動

使用/home/bind/sbin/named -u root -c /home/bind/etc/named.conf -g能夠查看啓動過程，方便排錯

測試時，會根據源IP判斷來源，而後解析到指定的地址，以下：

域名電信用戶解析IP 聯通用戶解析IP 移動用戶解析IP 其餘用戶解析IP

www.test.com 1.1.1.1 2.2.2.2 3.3.3.3 4.4.4.4

解析命令

dig @115.182.75.10 www.test.com A

nslookup www.test.com 115.182.75.10

host -t A www.test.com 115.182.75.10

附上一個bind自帶的壓力測試工具queryperf

在解壓 bind-9.9.5-P1.tar.gz後，在解壓的文件中有個queryperf的目錄，具體路徑爲：bind-9.9.5-P1/contrib/queryperf

在queryperf目錄下執行：sh configure && make

以後會生成一個queryperf執行文件

基本用法以下：

./queryperf -d domain-file -s 8.8.8.8 -l 60 -T100

-d 後接一個域名列表文件，一行一個域名，格式爲:domain type

www.163.com A

qq.com MX

www.baidu.com CNAME

www.test.com NS

-s 後接測試使用的DNS服務器IP

-l 測試時間，單位爲秒

-T 每秒發送的請求數（qps）

命令執行完成後會輸出結果，以下：

Statistics:

Parse input file: multiple times

Run time limit: 60 seconds

Ran through file: 5999 times

Queries sent: 6000 queries #查詢總請求數

Queries completed: 6000 queries #查詢成功的請求數

Queries lost: 0 queries #查詢失敗的請求數

Queries delayed(?): 0 queries

RTT max: 0.000520 sec

RTT min: 0.000109 sec

RTT average: 0.000291 sec

RTT std deviation: 0.000062 sec

RTT out of range: 0 queries

Percentage completed: 100.00%

Percentage lost: 0.00%

Started at: Fri Aug 15 10:42:00 2014

Finished at: Fri Aug 15 10:43:00 2014

Ran for: 60.000338 seconds

Queries per second: 99.999437 qps #每秒查詢的次數（qps）

Total QPS/target: 99.999437/100 qps

相關標籤/搜索

每日一句

每一个你不满意的现在，都有一个你没有努力的曾经。