智能DNS
对域名进行智能解析，能够根据客户端的IP的特点对相同域名解析为不同的IP。
用到DNS里的视图（view）功能:
类似于编程语言的if语句
if [ IP == "中国电信的IP" ];then
把域名解析电信机房的服务器的IP
elif [ IP == "网通IP" ];then
把域名解析网通机房的服务器的IP
else
默认返回电信机房的IP
fi
DNS视图：
view
准备：
静态IP
FQDN的主机名
绑定hosts文件
安装：
# yum install bind bind-chroot -y
一、建立IP列表
# vim /var/named/chroot/var/named/chinanet
acl chinanet {
10.1.1.101;
10.1.1.233;
10.1.1.110;
10.1.1.156;
10.1.1.123;
};
# vim /var/named/chroot/var/named/cnc
acl cnc {
10.1.1.1;
10.1.1.21;
10.1.1.22;
10.1.1.60;
10.1.1.175
10.1.1.50;
172.16.196.1;
172.16.196.2;
};
二、建立配置文件
# vim /var/named/chroot/etc/named.conf
options {
listen-on port 53 { any; };
directory "/var/named"; <---锁定之后，chroot之后的“/”
allow-query { any; };
};
include "cnc";<----访问列表： IP列表
include "chinanet";
view china_net {
match-clients { chinanet; }; <--- "chinanet" 是acl的名字
zone "upl.com." IN {
type master;
file "data/chinanet.upl.com.zone";
};
};
view china_cnc {
match-clients { cnc; };
zone "upl.com." IN {
type master;
file "data/cnc.upl.com.zone";
};
};
view other {
match-clients { any; };
zone "upl.com." IN {
type master;
file "data/other.upl.com.zone";
};
};
三、分别建立三个视图对应的区的定于文件
# vim /var/named/chroot/var/named/data/chinanet.upl.com.zone
$TTL 86400
@ IN SOA upl.com. root. (
2013022201
2M
1M
1D
1H )
@ IN NS www.upl.com.
www IN A 10.1.1.21
bbs IN A 10.1.1.10
# vim /var/named/chroot/var/named/data/cnc.upl.com.zone
$TTL 86400
@ IN SOA upl.com. root. (
2013022201
2M
1M
1D
1H )
@ IN NS www.upl.com.
www IN A 10.1.1.21
bbs IN A 10.1.1.11
# vim /var/named/chroot/var/named/data/other.upl.com.zone
$TTL 86400
@ IN SOA upl.com. root. (
2013022201
2M
1M
1D
1H )
@ IN NS www.upl.com.
www IN A 10.1.1.21
bbs IN A 10.1.1.12
# service named start
客户端去测试：
客户端的DNS必须指向我们自己配置的DNS服务器的IP
# vim /etc/resolv.conf
nameserver 10.1.1.21
# nslookup bbs.upl.com 《---- 不同网段的客户端解析bbs.upl.com返回不同的IP
例子：如何在视图的配置下增加一个DNS从服务器
一、在主DNS服务器上生成一个key
# rndc-confgen -a -c /etc/rndc.key
# cat /etc/rndc.key
# cat /var/named/chroot/etc/rndc.key 保证两个文件内容都一样
key "rndc-key" {
algorithm hmac-md5;
secret "PIeY8PMHKStmytRUnk2GCw==";
};
# vim /var/named/chroot/etc/named.conf
options {
listen-on port 53 { any; };
listen-on-v6 port 53 { any; };
directory "/var/named";
allow-query { any; };
};
include "/etc/rndc.key";
include "cnc";
include "chinanet";
controls {
inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { "rndc-key"; };
};
view china_net {
match-clients { chinanet;10.1.1.17; };
zone "upl.com." IN {
type master;
file "data/chinanet.upl.com.zone";
allow-transfer { key "rndc-key"; }; <--只要是能够提供正确密钥，都能下载区域文件成为从DNS服务器
};
};
view china_cnc {
match-clients { cnc;10.1.1.18; };
zone "upl.com." IN {
type master;
file "data/cnc.upl.com.zone";
allow-transfer { key "rndc-key"; };
};
};
view other {
match-clients { any; };
zone "upl.com." IN {
type master;
file "data/other.upl.com.zone";
allow-transfer { key "rndc-key"; };
};
};
二、配置从DNS
IP、FQDN、hosts
必须给从DNS安排3个IP
10.1.1.17模拟成电信IP
10.1.1.18模拟网通的IP
10.1.1.19模拟其他网络的IP
主、从之间时间要同步
# ntpdate 10.1.1.21
# ifconfig eth0 10.1.1.17 netmask 255.255.255.0
# ifconfig eth0:1 10.1.1.18 netmask 255.255.255.0
# ifconfig eth0:2 10.1.1.19 netmask 255.255.255.0
1、安装软件包 bind , bind-chroot
2、在Master(主DNS)上下载key文件/etc/rndc.key
# rsync -alvR 10.1.1.21:/var/named/chroot/etc/rndc.key /
# rsync -alvR 10.1.1.21:/etc/rndc.key /
# vim /var/named/chroot/etc/named.conf
如果不下载，可以直接把这个key文件的内容写在主配置中
3、下载IP列表文件，应该和master一样
# rsync -alvR 10.1.1.21:/var/named/chroot/var/named/chinanet /
# rsync -alvR 10.1.1.21:/var/named/chroot/var/named/cnc /
4、配置从DNS的配置文件
# vim /var/named/chroot/etc/named.conf
options {
listen-on port 53 { any; };
listen-on-v6 port 53 { any; };
directory "/var/named";
allow-query { any; };
};
key "rndc-key" {
algorithm hmac-md5;
secret "PIeY8PMHKStmytRUnk2GCw==";
};
include "cnc";
include "chinanet";
controls {
inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { "rndc-key"; };
};
view china_net {
match-clients { chinanet;};
transfer-source 10.1.1.17;
zone "upl.com." IN {
type slave;
file "slave/chinanet.upl.com.zone";
masters { 10.1.1.21 key "rndc-key"; };
};
};
view china_cnc {
match-clients { cnc; };
transfer-source 10.1.1.18;
zone "upl.com." IN {
type slave;
file "slave/cnc.upl.com.zone";
masters { 10.1.1.21 key "rndc-key"; };
};
};
view other {
match-clients { any; };
transfer-source 10.1.1.19;
zone "upl.com." IN {
type slave;
file "slave/other.upl.com.zone";
masters { 10.1.1.21 key "rndc-key"; };
};
};
# mkdir /var/named/chroot/var/named/slave
# chown named:named /var/named/chroot/var/named/slave
本文转自crazy_charles 51CTO博客，原文链接：http://blog.51cto.com/douya/1243780，如需转载请自行联系原作者
