使用BIND安装智能DNS服务器（三）---添加view和acl配置
智能DNS的配置主要修改named.conf文件，利用view和acl来实现。
acl文件内容,这里只列出一部分，具体详细的可以参考这个网址
纯真IP库，给出了十分详细的IP地址，下载安装后，打开软件，点击解压就可以获取到txt文本格式的IP地址
http://www.crsky.com/soft/2611.html
IP转换为acl工具下载地址
http://blog.lishixin.net/linux/468.html/attachment/dnstool
按照下面博客中的步骤将IP转换为acl格式
http://blog.lishixin.net/archives/468#more-468
注意事项：
只要配置了view的时候，所有的zone都必须包含到view中。
包括下面的这两行
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
下面是本配置中需要的，只列出部分IP的acl文件，这个不影响正常使用
mkdir -p /var/named/acl/srcip/
vim /var/named/acl/srcip/AnHui.acl
acl "AnHui.cnc"{
36.32.0.0/;
36.32.1.0/;
36.32.2.0/;
};
acl "AnHui.telcom"{
36.4.0.0/;
36.4.1.0/;
36.4.2.0/;
};
acl "AnHui.tietong"{
61.235.36.0/;
61.235.37.0/;
61.235.38.0/;
};
acl "AnHui.mobile"{
101.36.128.0/;
101.36.129.0/;
101.36.130.0/;
};
acl "AnHui.cernet"{
1.51.64.0/;
1.51.65.0/;
1.51.100.0/;
};
vim /var/named/acl/srcip/BeiJing.acl
acl "BeiJing.cnc"{
1.25.36.67;
1.25.36.68;
1.25.36.69;
};
acl "BeiJing.telcom"{
1.92.0.0/;
1.93.0.0;
1.93.0.1;
};
acl "BeiJing.tietong"{
36.192.0.0/;
36.192.1.0/;
36.192.2.0/;
};
acl "BeiJing.mobile"{
36.128.0.0/;
36.129.0.0/;
36.130.0.0/;
};
acl "BeiJing.cernet"{
42.247.0.128;
42.247.0.129;
42.247.0.130;
};
主DNS服务器配置，named.conf，修改后需要重启service named restart
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// include "/var/named/acl/srcip/AnHui.acl";
include "/var/named/acl/srcip/BeiJing.acl"; //include "/var/named/include_acl"; options {
listen-on port { 127.0.0.1; 192.168.1.100; }; //主DNS服务器
listen-on-v6 port { ::; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; 192.168.1.0/; };
allow-transfer { localhost; 192.168.1.101; }; //从DNS服务器
allow-query-cache { any; }; //注意没有这个将无法访问网页
recursion yes; dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto; /* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic";
}; logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
}; //电信
view "telcom-view" {
match-clients {
AnHui.telcom;
BeiJing.telcom;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type master;
file "forward.unixmen"; //正向解析文件名
allow-update { none; };
};
zone"1.168.192.in-addr.arpa" IN {
type master;
file "reverse.unixmen";//反向解析文件名
allow-update { none; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //联通
view "cnc-view" {
match-clients {
AnHui.cnc;
BeiJing.cnc;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type master;
file "forward.unixmen"; //正向解析文件名
allow-update { none; };
};
zone"1.168.192.in-addr.arpa" IN {
type master;
file "reverse.unixmen";//反向解析文件名
allow-update { none; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //移动
view "mobile-view" {
match-clients {
AnHui.mobile;
BeiJing.mobile;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type master;
file "forward.unixmen"; //正向解析文件名
allow-update { none; };
};
zone"1.168.192.in-addr.arpa" IN {
type master;
file "reverse.unixmen";//反向解析文件名
allow-update { none; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //中国教育与科研网
view "cernet-view" {
match-clients {
AnHui.cernet;
BeiJing.cernet;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type master;
file "forward.unixmen"; //正向解析文件名
allow-update { none; };
};
zone"1.168.192.in-addr.arpa" IN {
type master;
file "reverse.unixmen";//反向解析文件名
allow-update { none; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; view "external-view" {
match-clients { any; };
recursion yes; //需要递归，要不然上不了网。。。 zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type master;
file "forward.unixmen"; //正向解析文件名
allow-update { none; };
};
zone"1.168.192.in-addr.arpa" IN {
type master;
file "reverse.unixmen";//反向解析文件名
allow-update { none; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; key "rndc-key" {
algorithm hmac-md5;
secret "VcL5wC2GHCzCU7ju+ajC1Q==";
}; controls {
inet 0.0.0.0 port
allow { localhost; 192.168.1.101; } keys { "rndc-key"; };
};
从DNS服务器named.conf配置,修改后需要重启service named restart
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// include "/var/named/acl/srcip/AnHui.acl";
include "/var/named/acl/srcip/BeiJing.acl"; options {
listen-on port { 127.0.0.1;192.168.1.101; };
listen-on-v6 port { ::; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; };
allow-query-cache { any; };//注意没有这个将无法访问网页
recursion yes; dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto; /* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic";
}; logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
}; //电信
view "telcom-view" {
match-clients {
AnHui.telcom;
BeiJing.telcom;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type slave;
file "slaves/unixmen.fwd";
masters { 192.168.1.100; };#主DNS
}; zone"1.168.192.in-addr.arpa" IN {
type slave;
file "slaves/unixmen.rev";
masters { 192.168.1.100; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //联通
view "cnc-view" {
match-clients {
AnHui.cnc;
BeiJing.cnc;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type slave;
file "slaves/unixmen.fwd";
masters { 192.168.1.100; };#主DNS
}; zone"1.168.192.in-addr.arpa" IN {
type slave;
file "slaves/unixmen.rev";
masters { 192.168.1.100; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //移动
view "mobile-view" {
match-clients {
AnHui.mobile;
BeiJing.mobile;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type slave;
file "slaves/unixmen.fwd";
masters { 192.168.1.100; };#主DNS
}; zone"1.168.192.in-addr.arpa" IN {
type slave;
file "slaves/unixmen.rev";
masters { 192.168.1.100; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //中国教育与科研网
view "cernet-view" {
match-clients {
AnHui.cernet;
BeiJing.cernet;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type slave;
file "slaves/unixmen.fwd";
masters { 192.168.1.100; };#主DNS
}; zone"1.168.192.in-addr.arpa" IN {
type slave;
file "slaves/unixmen.rev";
masters { 192.168.1.100; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; view "external-view" {
match-clients { any; };
recursion yes; //需要递归，要不然上不了网。。。 zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type slave;
file "slaves/unixmen.fwd";
masters { 192.168.1.100; };#主DNS
}; zone"1.168.192.in-addr.arpa" IN {
type slave;
file "slaves/unixmen.rev";
masters { 192.168.1.100; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; key "rndc-key" {
algorithm hmac-md5;
secret "VcL5wC2GHCzCU7ju+ajC1Q==";
}; controls {
inet * port
allow { 127.0.0.1;192.168.1.100; } keys { "rndc-key"; };
};
使用BIND安装智能DNS服务器（三）---添加view和acl配置的更多相关文章
- 使用BIND安装智能DNS服务器（一）---基本的主从DNS服务器搭建
参考网址:http://www.unixmen.com/dns-server-installation-step-by-step-using-centos-6-3/ DNS(Domain Name S ...
- 使用BIND安装智能DNS服务器（二）---配置rndc远程控制
首先两个BIND DNS服务器要正常运行. 主DNS服务器IP:192.168.1.100 客户机DNS服务器IP:192.168.1.101 1 主DNS端配置: cd /etc/ 生成 ...
- 使用bind实现主从DNS服务器数据同步
一.bind简介 Linux中通常使用bind来实现DNS服务器的架设,bind软件由isc(www.isc.org)维护.在yum仓库中可以找到软件,配置好yum源,直接使用命令yum instal ...
- Bind 远程连接DNS服务器时出现 rndc: connection to remote host closed
使用命令:rndc -s 192.168.1.2 status 连接远程的bind 搭建的DNS服务器时出现下面的错误: rndc: connection to remote host close ...
- Linux DNS分离解析与构建智能DNS服务器
一 构建DNS分离解析 方法一 : [root@localhost ~]# vim /etc/named.conf [root@localhost ~]# cd /var/named/ [root@l ...
- linux下DNS服务器搭建，正反向解析配置
dns服务器之前自己搭建玩过,一段时间不搞,加上当时没写文档,基本忘光光了,这次老实了,写个文档记下来,方便以后查阅. 1.服务器准备 为了避免不必要的问题,关闭防火墙,关闭selinux,hosts ...
- 在 CentOS7.0 上搭建 Chroot 的 Bind DNS 服务器
BIND(Berkeley internet Name Daemon)也叫做NAMED,是现今互联网上使用最为广泛的DNS 服务器程序.这篇文章将要讲述如何在 chroot 监牢中运行 BIND,这样 ...
- 【转】在CentOS 8 / RHEL 8上配置主/从BIND DNS服务器
转自: https://zh.codepre.com/centos-2700.html 前言 本指南描述了在CentOS 8 / RHEL 8 Linux上配置BIND DNS服务器所需的步骤.在Ce ...
- 2-7-搭建DNS服务器实现域名解析
学习服务的方法: 了解服务的作用:名称,功能,特点 安装服务 配置文件的位置,端口 服务开启和关闭的脚本 修改配置文件(实战举例) 排错(从上到下,从内到外) -------------------- ...
随机推荐
- 高性能流媒体服务器EasyDSS前端重构(二) webpack + vue + AdminLTE 多页面提取共用文件, 优化编译时间
本文围绕着实现EasyDSS高性能流媒体服务器的前端框架来展开的,具体EasyDSS的相关信息可在:www.easydss.com 找到! 接上回 <高性能流媒体服务器EasyDSS前端重构(一 ...
- Dominant Resource Fairness: Fair Allocation of Multiple Resource Types
Dominant Resource Fairness: Fair Allocation of Multiple Resource Types
- m*n matrix min rank square matrix
m*n matrix m*n=1000 f(A)=25 https://www.cs.princeton.edu/courses/archive/spring12/cos598C/svdchapter ...
- 怎样做大做强企业中的ERP？
版权声明:本文为博主原创文章,未经博主同意不得转载. https://blog.csdn.net/luozhonghua2014/article/details/37672409 ...
- php微信支付测试开发（流程已通）
必要条件: appid //公众号后台开发者中心获得(和邮件内的一样) mchid//邮件内获得 key//商户后台自己设置 appsecret //公众号开发者中心获得 两个证书文件,邮件内 ...
- ABAP-创建物料主数据
CALL FUNCTION 'BAPI_MATERIAL_SAVEDATA' *&------------------------------------------------------- ...
- MySQL——sql语句的执行顺序
#核心知识点: 书写顺序:where——>group by——>having——>order by——>limit 许多时候在书写一些复杂的sql语句的时候,尤其是在渐进式推导 ...
- STM32 FSMC学习笔记+补充（LCD的FSMC配置）
STM32 FSMC学习笔记+补充(LCD的FSMC配置) STM32 FSMC学习笔记 STM32 FSMC的用法--LCD
- python 安装coreml
2.安装pip, 下载get-pip.py, https://bootstrap.pypa.io/get-pip.py,然后Python 这个文件,如果没有权限就加sudo 3.安装coreml:这 ...
- echarts如何显示在页面上
echarts如何显示在页面上 1.引入echarts的相关.js文件 <script src="js/echarts.min.js"></script> ...