Linux DNS利用view實現智能轉發

時間 2020-01-04

標籤 linux dns 利用 view 實現智能轉發欄目 Linux 简体版

原文原文鏈接

實施步驟:
1.電信和網通各一臺服務器
2.使用BIND9作智能DNS,自動根據客戶端IP來判斷,網通的用戶解析出網通的IP,電信的解析出電信IP.
3.將其中一臺服務器作成反向代理,這樣數據就能夠同步了,不須要爲同步數據麻煩.
注意:
若是你想讓本身的服務器不一樣線路訪問不一樣的服務器,
或者某個區域訪問本身區域的服務器使用該view功能就能夠實現
好比:國外的訪問國外服務器國內訪問國內服務器.
測試作的域名
www.sc-linux.com
電信IP218.6.242.216
網通IP61.182.49.7
電信用戶PING www.sc-linux.com會解析到218.6.242.216
網通用戶PING www.sc-linux.com會解析到61.182.49.7
批註:該功能主要是解決了北京某門戶網站的南北互不相訪的問題.
配置步驟：
一、軟件列表
BIND 9.3.2
ftp://ftp.isc.org/isc/bind9/9.3.2/bind-9.3.2.tar.gz
二、安裝BIND 9
安裝BIND9：
# tar zxvf bind-9.3.2.tar.gz
# cd bind-9.3.2
# ./configure
--prefix=/usr/local/named
--disable-ipv6
# make && make install
創建BIND用戶：
# groupadd bind
# useradd -g bind -d /usr/local/named -s /sbin/nologin bind
建立配置文件目錄：
# mkdir –p /usr/local/named/etc
# chown bind:bind /usr/local/named/etc
# chmod 700 /usr/local/named/etc
建立主要的配置文件：
# vi /usr/local/named/etc/named.conf
===========================named.conf=======================
acl "trust-lan" { 127.0.0.1/8; 192.168.0.0/16;};
options {
directory "/usr/local/named/etc/";
pid-file "/var/run/named/named.pid";
version "0.0.0";
datasize 40M;
allow-transfer {
"trust-lan";};
recursion yes;
allow-notify {
"trust-lan";
};
allow-recursion {
"trust-lan";
};
auth-nxdomain no;
forwarders {
202.99.160.68;
202.99.168.8;};
};
logging {
channel warning
{ file "/var/log/named/dns_warnings" versions 3 size 1240k;
severity warning;
print-category yes;
print-severity yes;
print-time yes;
};
channel general_dns
{ file "/var/log/named/dns_logs" versions 3 size 1240k;
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
category default { warning; };
category queries { general_dns; };
};
zone "." {
type hint;
file "named.root";
};
acl "CNC" {
58.16.0.0/16;
58.17.0.0/17;
58.17.128.0/17;
58.18.0.0/16;
58.19.0.0/16;
58.20.0.0/16;
58.21.0.0/16;
58.22.0.0/15;
58.240.0.0/15;
58.242.0.0/15;
58.244.0.0/15;
58.246.0.0/15;
58.248.0.0/13;
60.0.0.0/13;
60.8.0.0/15;
60.10.0.0/16;
60.11.0.0/16;
60.12.0.0/16;
60.13.0.0/18;
60.13.128.0/17;
60.14.0.0/15;
60.16.0.0/13;
60.24.0.0/14;
60.30.0.0/16;
60.31.0.0/16;
60.208.0.0/13;
60.216.0.0/15;
60.218.0.0/15;
60.220.0.0/14;
61.48.0.0/13;
61.133.0.0/17;
61.134.96.0/19;
61.134.128.0/17;
61.135.0.0/16;
61.137.128.0/17;
61.138.0.0/17;
61.138.128.0/18;
61.139.128.0/18;
61.148.0.0/15;
61.156.0.0/16;
61.159.0.0/18;
61.161.0.0/18;
61.161.128.0/17;
61.162.0.0/16;
61.163.0.0/16;
61.167.0.0/16;
61.168.0.0/16;
61.176.0.0/16;
61.179.0.0/16;
61.181.0.0/16;
61.182.0.0/16;
61.189.0.0/17;
125.32.0.0/16;
125.40.0.0/13;
202.96.0.0/18;
202.96.64.0/21;
202.96.72.0/21;
202.97.128.0/18;
202.97.224.0/21;
202.97.240.0/20;
202.98.0.0/21;
202.98.8.0/21;
202.99.64.0/19;
202.99.96.0/21;
202.99.128.0/19;
202.99.160.0/21;
202.99.168.0/21;
202.99.176.0/20;
202.99.208.0/20;
202.99.224.0/21;
202.99.232.0/21;
202.99.240.0/20;
202.102.128.0/21;
202.102.224.0/21;
202.102.232.0/21;
202.106.0.0/16;
202.107.0.0/17;
202.108.0.0/16;
202.110.0.0/17;
202.111.128.0/18;
203.93.8.0/24;
203.93.192.0/18;
210.13.128.0/17;
210.14.160.0/19;
210.14.192.0/19;
210.15.32.0/19;
210.15.96.0/19;
210.15.128.0/18;
210.21.0.0/16;
210.52.128.0/17;
210.53.0.0/17;
210.53.128.0/17;
210.74.96.0/19;
210.74.128.0/19;
210.82.0.0/15;
218.8.0.0/14;
218.12.0.0/16;
218.21.128.0/17;
218.24.0.0/14;
218.56.0.0/14;
218.60.0.0/15;
218.67.128.0/17;
218.68.0.0/15;
218.104.0.0/14;
219.154.0.0/15;
219.156.0.0/15;
219.158.0.0/17;
219.158.128.0/17;
219.159.0.0/18;
220.252.0.0/16;
221.0.0.0/15;
221.2.0.0/16;
221.3.0.0/17;
221.3.128.0/17;
221.4.0.0/16;
221.5.0.0/17;
221.5.128.0/17;
221.6.0.0/16;
221.7.0.0/19;
221.7.32.0/19;
221.7.64.0/19;
221.7.96.0/19;
221.8.0.0/15;
221.10.0.0/16;
221.11.0.0/17;
221.11.128.0/18;
221.11.192.0/19;
221.12.0.0/17;
221.12.128.0/18;
221.13.0.0/18;
221.13.64.0/19;
221.13.96.0/19;
221.13.128.0/17;
221.14.0.0/15;
221.192.0.0/15;
221.194.0.0/16;
221.195.0.0/16;
221.196.0.0/15;
221.198.0.0/16;
221.199.0.0/19;
221.199.32.0/20;
221.199.128.0/18;
221.199.192.0/20;
221.200.0.0/14;
221.204.0.0/15;
221.206.0.0/16;
221.207.0.0/18;
221.207.64.0/18;
221.207.128.0/17;
221.208.0.0/14;
221.212.0.0/16;
221.213.0.0/16;
221.216.0.0/13;
222.128.0.0/14;
222.132.0.0/14;
222.136.0.0/13;
222.160.0.0/15;
222.162.0.0/16;
222.163.0.0/19;
222.163.32.0/19;
222.163.64.0/18;
222.163.128.0/17;
};
view "view_cnc" {
match-clients { CNC; };
zone "." {
type hint;
file "named.root";
};
zone "0.0.127.IN-ADDR.ARPA" {
type master;
file "localhost.rev";
};
include "master/cnc.def";
};
view "view_any" {
match-clients { any; };
zone "." {
type hint;
file "named.root";
};
zone "0.0.127.IN-ADDR.ARPA" {
type master;
file "localhost.rev";
};
include "master/telecom.def";
};
添加完成後，保存。
更新根區文件：
# cd /usr/local/named/etc/
# wget ftp://ftp.internic.org/domain/named.root
建立PID和日誌文件：
# mkdir /var/run/named/
# chmod 777 /var/run/named/
# chown bind:bind /var/run/named/
# mkdir /var/log/named/
# touch /var/log/named/dns_warnings
# touch /var/log/named/dns_logs
# chown bind:bind /var/log/named/*
# mkdir master
# touch master/cnc.def
# touch master/telecom.def
生成rndc-key：
# cd /usr/local/named/etc/
# ../sbin/rndc-confgen > rndc.conf
把rndc.conf中：
# Use with the following in named.conf, adjusting the allow list as needed:
後面以的部分加到/usr/local/named/etc/named.conf中並去掉註釋
運行測試：
# /usr/local/named/sbin/named -gc /usr/local/named/etc/named.conf &
狀態檢查：
# /usr/local/named/sbin/rndc status
創建啓動腳本：
# vi /etc/init.d/named
============================== named.sh============================
#!/bin/bash
#
# named a network name service.
#
#
# chkconfig: 545 35 75
# description: a name server
#
if [ `id -u` -ne 0 ]
then
echo "ERROR:For bind to port 53,must run as root."
exit 1
fi
case "$1" in
start)
if [ -x /usr/local/named/sbin/named ]; then
/usr/local/named/sbin/named -u bind -c /usr/local/named/etc/named.conf && echo . && echo BIND9 server started.
fi
;;
stop)
kill `cat /var/run/named/pid` && echo . && echo BIND9 server stopped.
;;
restart)
echo .
echo "Restart BIND9 server"
$0 stop
sleep 10
$0 start
;;
*)
echo "$0 start | stop | restart"
;;
esac
===============================named.sh============================
# chmod 755 /etc/init.d/named
# chown root:root /etc/init.d/named
# chkconfig --add named
# chkconfig named on

到這裏bind已經安裝完畢 .下面是解析部分.

三、添加一個NS
平時你們修改域名信息的時候，都會發現有一個DNS信息的修改，裏面會有一些相似
ns.sc-linux.com同樣的東西。添加這個東西不難，在新網的後臺就能夠添加。添加
的時候要注意,域名狀態設置裏面的域名必須不能在鎖定狀態。
登錄新網的後臺->域名管理->註冊本域名下的DNS->DNS名字:ns->IP地址*.*.*.*
（按照本身要求修改IP地址）->肯定->MyDNS功能->添加新的A記錄->ns->IP地址
61.182.49.7->提交。
對於一些收費的（如萬網）或者不提供DNS服務器註冊的管理後臺，咱們同樣有辦法去
解決。首先按照上面的，先添加一個A記錄，而後打開
http://domain.cnic.ac.cn/domain/nameserver/createhost.jsp
按照上面的提示註冊一下就行。
OK，等待DNS生效吧
四、添加一個域名
# cd /usr/local/named/etc/master
# mkdir cnc
# mkdir telecom
# vi cnc.def
添加
zone "sc-linux.com" {
type master;
file "master/cnc/sc-linux.com";
};
# vi telecom.def
添加
zone "sc-linux.com" {
type master;
file "master/telecom/sc-linux.com";
};
添加網通的解析，解析到的IP爲61.182.49.7
#vi cnc/sc-linux.com
添加
$TTL 3600
$ORIGIN sc-linux.com.
@ IN SOA ns.sc-linux.com. root.ns.sc-linux.com.(
2005121013 ;Serial
3600 ; Refresh ( seconds )
900 ; Retry ( seconds )
68400 ; Expire ( seconds )
15 );Minimum TTL for Zone ( seconds )
;
@ IN NS ns.sc-linux.com.
@ IN A 61.182.49.7
www IN A 61.182.49.7
;
;end
添加電信的解析，解析到的IP爲218.6.242.216
#vi telecom/sc-linux.com
添加
$TTL 3600
$ORIGIN sc-linux.com.
@ IN SOA ns.sc-linux.com. root.ns.sc-linux.com.(
2005121013 ;Serial
3600 ; Refresh ( seconds )
900 ; Retry ( seconds )
68400 ; Expire ( seconds )
15 );Minimum TTL for Zone ( seconds )
;
@ IN NS ns.sc-linux.com.
@ IN A 218.6.242.216
www IN A 218.6.242.216
;
;end
#/usr/local/named/sbin/rndc reload
OK，到此你的DNS服務器就算是跑起來了。試一下分別用網通和電信的線路ping一下吧.
批註後記:
如下方法能夠查詢到3個服務商大體的地址範圍，不過是否完整還須要你們驗證。
下載並編譯最新的ripe-dbase-client
# wget http://ftp.apnic.net/apnic/dbase ... se-client-v3.tar.gz
#tar zxvf ripe-dbase*.gz
#cd whois-3.1
#./configure;make
執行查詢並輸出結果
#./whois3 -h whois.apnic.net -l -i mb MAINT-CNCGROUP >/tmp/cnc
#./whois3 -h whois.apnic.net -l -i mb MAINT-CHINANET >/tmp/chinanet
#./whois3 -h whois.apnic.net -l -i mb MAINT-CN-CRTC > /tmp/crtc
若是想獲得具體的服務商好比江蘇省電信的IP池，就把mb的值改成MAINT-CHINANET-JS，或者是遼寧網通，那就改成MAINT-CNCGROUP-LN
而後用grep 和sed去掉多餘的文字就能夠獲得了