注意
- acl 规则一定是在options前面的
- 有了view，就不能再单独使用zone
修改主配置文件
vim /etc/named.conf
#acl 规则一定是在options前面的
acl beijinacl {
192.168.3.0/24; #根据ip地址不同，分成不同的规则
};
acl shanghaiacl {
192.168.2.0/24;
};
acl otheracl {
any;
};
options {
// listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
allow-query { any; };
allow-transfer {none;};
dnssec-enable no;
dnssec-validation no;
#新建view 将区域文件和规则绑定起来 所有区域都应该放在view中
view beijinview {
match-clients { beijinacl; };
include "/etc/named.rfc1912.zones.beijin";
};
view shanghaiview {
match-clients { shanghaiacl; };
include "/etc/named.rfc1912.zones.shanghai";
};
view otherview {
match-clients { otheracl; };
include "/etc/named.rfc1912.zones.other";
};
include "/etc/named.root.key";
修改区域配置文件
#做相应的三份区域配置文件
$ cp -p /etc/named.rfc1912.zones /etc/named.rfc1912.zones.beijin
$ cp -p /etc/named.rfc1912.zones /etc/named.rfc1912.zones.shanghai
$ cp -p /etc/named.rfc1912.zones /etc/named.rfc1912.zones.other
vim /etc/named.rfc1912.zones.beijin
zone "." IN {
type hint;
file "named.ca";
};
#将区域数据库和区域配置文件绑定
zone "hxg.com" IN {
type master;
file "hxg.com.zone.beijin";
};
vim /etc/named.rfc1912.zones.shanghai
zone "." IN {
type hint;
file "named.ca";
};
zone "hxg.com" IN {
type master;
file "hxg.com.zone.shanghai";
};
$ vim /etc/named.rfc1912.zones.other
zone "." IN {
type hint;
file "named.ca";
};
zone "hxg.com" IN {
type master;
file "hxg.com.zone.other";
};
新建区域数据库文件
#复制修改文件
$ cp -p /var/named/hxg.com.zone /var/named/hxg.com.zone.beijin
$ cp -p /var/named/hxg.com.zone /var/named/hxg.com.zone.shanghai
$ cp -p /var/named/hxg.com.zone /var/named/hxg.com.zone.other
vim /var/named/hxg.com.zone.beijin
$TTL 1D
@ IN SOA master admin ( 51 2H 10M 1W 1D )
NS master
master A 192.168.3.102
ap A 1.1.1.1
www CNAME ap
$ vim /var/named/hxg.com.zone.shanghai
$TTL 1D
@ IN SOA master admin ( 51 2H 10M 1W 1D )
NS master
master A 192.168.3.102
ap A 2.2.2.2
www CNAME ap
$ vim /var/named/hxg.com.zone.other
$TTL 1D
@ IN SOA master admin ( 51 2H 10M 1W 1D )
NS master
master A 192.168.3.102
ap A 3.3.3.3
www CNAME ap
检查配置文件语法
$ named-checkconf
检测区域数据库文件语法
$ named-checkzone hxg.com /var/named/hxg.com.zone.beijin
zone hxg.com/IN: loaded serial 51
OK
$ named-checkzone hxg.com /var/named/hxg.com.zone.shanghai
zone hxg.com/IN: loaded serial 51
OK
$ named-checkzone hxg.com /var/named/hxg.com.zone.other
zone hxg.com/IN: loaded serial 51
OK
测试
先在两台不同的主机上配置ip
ip a a 192.168.2.102/24 dev ens32
ip a a 192.168.2.101/24 dev ens32
然后测试
$ dig www.hxg.com @192.168.3.102
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7 <<>> www.hxg.com @192.168.3.102
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64966
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.hxg.com. IN A
;; ANSWER SECTION:
www.hxg.com. 86400 IN CNAME ap.hxg.com.
ap.hxg.com. 86400 IN A 1.1.1.1
;; AUTHORITY SECTION:
hxg.com. 86400 IN NS master.hxg.com.
;; ADDITIONAL SECTION:
master.hxg.com. 86400 IN A 192.168.3.102
;; Query time: 0 msec
;; SERVER: 192.168.3.102#53(192.168.3.102)
;; WHEN: 一 6月 08 14:38:18 CST 2020
;; MSG SIZE rcvd: 110
$ dig www.hxg.com @192.168.2.102
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7 <<>> www.hxg.com @192.168.2.102
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65135
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.hxg.com. IN A
;; ANSWER SECTION:
www.hxg.com. 86400 IN CNAME ap.hxg.com.
ap.hxg.com. 86400 IN A 2.2.2.2
;; AUTHORITY SECTION:
hxg.com. 86400 IN NS master.hxg.com.
;; ADDITIONAL SECTION:
master.hxg.com. 86400 IN A 192.168.3.102
;; Query time: 0 msec
;; SERVER: 192.168.2.102#53(192.168.2.102)
;; WHEN: 一 6月 08 14:45:05 CST 2020
;; MSG SIZE rcvd: 110
$ dig www.hxg.com @127.0.0.1
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-16.P2.el7 <<>> www.hxg.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27899
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.hxg.com. IN A
;; ANSWER SECTION:
www.hxg.com. 86400 IN CNAME ap.hxg.com.
ap.hxg.com. 86400 IN A 3.3.3.3
;; AUTHORITY SECTION:
hxg.com. 86400 IN NS master.hxg.com.
;; ADDITIONAL SECTION:
master.hxg.com. 86400 IN A 192.168.3.102
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: 一 6月 08 14:37:57 CST 2020
;; MSG SIZE rcvd: 110