使用BIND安装智能DNS服务器（三）---添加view和acl配置
智能DNS的配置主要修改named.conf文件，利用view和acl来实现。
acl文件内容,这里只列出一部分，具体详细的可以参考这个网址
纯真IP库，给出了十分详细的IP地址，下载安装后，打开软件，点击解压就可以获取到txt文本格式的IP地址
http://www.crsky.com/soft/2611.html
IP转换为acl工具下载地址
http://blog.lishixin.net/linux/468.html/attachment/dnstool
按照下面博客中的步骤将IP转换为acl格式
http://blog.lishixin.net/archives/468#more-468
注意事项：
只要配置了view的时候，所有的zone都必须包含到view中。
包括下面的这两行
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
下面是本配置中需要的，只列出部分IP的acl文件，这个不影响正常使用
mkdir -p /var/named/acl/srcip/
vim /var/named/acl/srcip/AnHui.acl
acl "AnHui.cnc"{
36.32.0.0/;
36.32.1.0/;
36.32.2.0/;
};
acl "AnHui.telcom"{
36.4.0.0/;
36.4.1.0/;
36.4.2.0/;
};
acl "AnHui.tietong"{
61.235.36.0/;
61.235.37.0/;
61.235.38.0/;
};
acl "AnHui.mobile"{
101.36.128.0/;
101.36.129.0/;
101.36.130.0/;
};
acl "AnHui.cernet"{
1.51.64.0/;
1.51.65.0/;
1.51.100.0/;
};
vim /var/named/acl/srcip/BeiJing.acl
acl "BeiJing.cnc"{
1.25.36.67;
1.25.36.68;
1.25.36.69;
};
acl "BeiJing.telcom"{
1.92.0.0/;
1.93.0.0;
1.93.0.1;
};
acl "BeiJing.tietong"{
36.192.0.0/;
36.192.1.0/;
36.192.2.0/;
};
acl "BeiJing.mobile"{
36.128.0.0/;
36.129.0.0/;
36.130.0.0/;
};
acl "BeiJing.cernet"{
42.247.0.128;
42.247.0.129;
42.247.0.130;
};
主DNS服务器配置，named.conf，修改后需要重启service named restart
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// include "/var/named/acl/srcip/AnHui.acl";
include "/var/named/acl/srcip/BeiJing.acl"; //include "/var/named/include_acl"; options {
listen-on port { 127.0.0.1; 192.168.1.100; }; //主DNS服务器
listen-on-v6 port { ::; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; 192.168.1.0/; };
allow-transfer { localhost; 192.168.1.101; }; //从DNS服务器
allow-query-cache { any; }; //注意没有这个将无法访问网页
recursion yes; dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto; /* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic";
}; logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
}; //电信
view "telcom-view" {
match-clients {
AnHui.telcom;
BeiJing.telcom;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type master;
file "forward.unixmen"; //正向解析文件名
allow-update { none; };
};
zone"1.168.192.in-addr.arpa" IN {
type master;
file "reverse.unixmen";//反向解析文件名
allow-update { none; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //联通
view "cnc-view" {
match-clients {
AnHui.cnc;
BeiJing.cnc;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type master;
file "forward.unixmen"; //正向解析文件名
allow-update { none; };
};
zone"1.168.192.in-addr.arpa" IN {
type master;
file "reverse.unixmen";//反向解析文件名
allow-update { none; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //移动
view "mobile-view" {
match-clients {
AnHui.mobile;
BeiJing.mobile;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type master;
file "forward.unixmen"; //正向解析文件名
allow-update { none; };
};
zone"1.168.192.in-addr.arpa" IN {
type master;
file "reverse.unixmen";//反向解析文件名
allow-update { none; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //中国教育与科研网
view "cernet-view" {
match-clients {
AnHui.cernet;
BeiJing.cernet;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type master;
file "forward.unixmen"; //正向解析文件名
allow-update { none; };
};
zone"1.168.192.in-addr.arpa" IN {
type master;
file "reverse.unixmen";//反向解析文件名
allow-update { none; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; view "external-view" {
match-clients { any; };
recursion yes; //需要递归，要不然上不了网。。。 zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type master;
file "forward.unixmen"; //正向解析文件名
allow-update { none; };
};
zone"1.168.192.in-addr.arpa" IN {
type master;
file "reverse.unixmen";//反向解析文件名
allow-update { none; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; key "rndc-key" {
algorithm hmac-md5;
secret "VcL5wC2GHCzCU7ju+ajC1Q==";
}; controls {
inet 0.0.0.0 port
allow { localhost; 192.168.1.101; } keys { "rndc-key"; };
};
从DNS服务器named.conf配置,修改后需要重启service named restart
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// include "/var/named/acl/srcip/AnHui.acl";
include "/var/named/acl/srcip/BeiJing.acl"; options {
listen-on port { 127.0.0.1;192.168.1.101; };
listen-on-v6 port { ::; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; };
allow-query-cache { any; };//注意没有这个将无法访问网页
recursion yes; dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto; /* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic";
}; logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
}; //电信
view "telcom-view" {
match-clients {
AnHui.telcom;
BeiJing.telcom;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type slave;
file "slaves/unixmen.fwd";
masters { 192.168.1.100; };#主DNS
}; zone"1.168.192.in-addr.arpa" IN {
type slave;
file "slaves/unixmen.rev";
masters { 192.168.1.100; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //联通
view "cnc-view" {
match-clients {
AnHui.cnc;
BeiJing.cnc;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type slave;
file "slaves/unixmen.fwd";
masters { 192.168.1.100; };#主DNS
}; zone"1.168.192.in-addr.arpa" IN {
type slave;
file "slaves/unixmen.rev";
masters { 192.168.1.100; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //移动
view "mobile-view" {
match-clients {
AnHui.mobile;
BeiJing.mobile;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type slave;
file "slaves/unixmen.fwd";
masters { 192.168.1.100; };#主DNS
}; zone"1.168.192.in-addr.arpa" IN {
type slave;
file "slaves/unixmen.rev";
masters { 192.168.1.100; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //中国教育与科研网
view "cernet-view" {
match-clients {
AnHui.cernet;
BeiJing.cernet;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type slave;
file "slaves/unixmen.fwd";
masters { 192.168.1.100; };#主DNS
}; zone"1.168.192.in-addr.arpa" IN {
type slave;
file "slaves/unixmen.rev";
masters { 192.168.1.100; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; view "external-view" {
match-clients { any; };
recursion yes; //需要递归，要不然上不了网。。。 zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type slave;
file "slaves/unixmen.fwd";
masters { 192.168.1.100; };#主DNS
}; zone"1.168.192.in-addr.arpa" IN {
type slave;
file "slaves/unixmen.rev";
masters { 192.168.1.100; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; key "rndc-key" {
algorithm hmac-md5;
secret "VcL5wC2GHCzCU7ju+ajC1Q==";
}; controls {
inet * port
allow { 127.0.0.1;192.168.1.100; } keys { "rndc-key"; };
};
使用BIND安装智能DNS服务器（三）---添加view和acl配置的更多相关文章
- 使用BIND安装智能DNS服务器（一）---基本的主从DNS服务器搭建
参考网址:http://www.unixmen.com/dns-server-installation-step-by-step-using-centos-6-3/ DNS(Domain Name S ...
- 使用BIND安装智能DNS服务器（二）---配置rndc远程控制
首先两个BIND DNS服务器要正常运行. 主DNS服务器IP:192.168.1.100 客户机DNS服务器IP:192.168.1.101 1 主DNS端配置: cd /etc/ 生成 ...
- 使用bind实现主从DNS服务器数据同步
一.bind简介 Linux中通常使用bind来实现DNS服务器的架设,bind软件由isc(www.isc.org)维护.在yum仓库中可以找到软件,配置好yum源,直接使用命令yum instal ...
- Bind 远程连接DNS服务器时出现 rndc: connection to remote host closed
使用命令:rndc -s 192.168.1.2 status 连接远程的bind 搭建的DNS服务器时出现下面的错误: rndc: connection to remote host close ...
- Linux DNS分离解析与构建智能DNS服务器
一 构建DNS分离解析 方法一 : [root@localhost ~]# vim /etc/named.conf [root@localhost ~]# cd /var/named/ [root@l ...
- linux下DNS服务器搭建，正反向解析配置
dns服务器之前自己搭建玩过,一段时间不搞,加上当时没写文档,基本忘光光了,这次老实了,写个文档记下来,方便以后查阅. 1.服务器准备 为了避免不必要的问题,关闭防火墙,关闭selinux,hosts ...
- 在 CentOS7.0 上搭建 Chroot 的 Bind DNS 服务器
BIND(Berkeley internet Name Daemon)也叫做NAMED,是现今互联网上使用最为广泛的DNS 服务器程序.这篇文章将要讲述如何在 chroot 监牢中运行 BIND,这样 ...
- 【转】在CentOS 8 / RHEL 8上配置主/从BIND DNS服务器
转自: https://zh.codepre.com/centos-2700.html 前言 本指南描述了在CentOS 8 / RHEL 8 Linux上配置BIND DNS服务器所需的步骤.在Ce ...
- 2-7-搭建DNS服务器实现域名解析
学习服务的方法: 了解服务的作用:名称,功能,特点 安装服务 配置文件的位置,端口 服务开启和关闭的脚本 修改配置文件(实战举例) 排错(从上到下,从内到外) -------------------- ...
随机推荐
- [转]Struts form传值
Struts form传值 大约三四个月没用过struts框架,突然想拾起来,却发现好多都忘了.出现传值传不过来的问题.没办法,上网查了一下,看见了一位老师的帖子,总结的很好.特此转载与分享,文末附链 ...
- crm高速开发之EntityCollection
/* 创建者:菜刀居士的博客 * 创建日期:2014年07月07号 */ namespace Net.CRM.OrganizationService { using System; ...
- .net概念（转）
你主要想问.Net和Java的差异在哪里 Java是开发语言 .Net叫开发平台 但事实上你管Java叫开发平台也没错 平台就是一个供你在上面进行开发的平台 (英语叫Framework,也可以翻译成“ ...
- 负载均衡，会话保持，session同步(转)
一,什么负载均衡一个新网站是不要做负载均衡的,因为访问量不大,流量也不大,所以没有必要搞这些东西.但是随着网站访问量和流量的快速增长,单台服务器受自身硬件条件的限制,很难承受这么大的访问量.在这种情况 ...
- iOS 9 Safari广告拦截插件
相对于谷歌对广告拦截的禁止,苹果与之态度截然相反,继Mac版Safari加入广告拦截工具之后,即将到来的iOS9对Safari也引入了内容拦截插件-Content Blocker,并且开发者可以使用最 ...
- mini2440 u-boot下设置tftp
在烧写好u-boot后,重新启动mini2440,一直按空格键进入u-boot界面: U-Boot 月 - ::) modified by tekkamanninja (tekkamanninja@. ...
- React Native 微信分享闪退的解决办法
Android中编写微信分享功能时出现了闪退的现象,经过几番资料的查找,发现是应用签名的问题,解决办法如下: 1. 进入微信官网的开放平台--->资源中心---->资源下载----& ...
- 9.2 NOIP提高组试题精解(2)
9-18 fruit.c #include <stdio.h> #define MAXN 10000 int Queue1[MAXN], Queue2[MAXN]; void Insert ...
- BZOJ 1041 [HAOI2008]圆上的整点：数学【费马平方和定理】
题目链接:http://www.lydsy.com/JudgeOnline/problem.php?id=1041 题意: 给定n(n <= 2*10^9),问你在圆x^2 + y^2 = n^ ...
- PHP的Calling Scope（::调用非静态方法）
今天在群里发现有人说,PHP可以用::调用非静态方法,一致没这么试过,发现了鸟哥的blog写了这个问题的具体解释,就搬过来: 这个问题乍看, 确实很容易让人迷惑, 但实际上, 造成这样的误解的根本原因 ...