使用BIND安装智能DNS服务器（三）---添加view和acl配置
智能DNS的配置主要修改named.conf文件，利用view和acl来实现。
acl文件内容,这里只列出一部分，具体详细的可以参考这个网址
纯真IP库，给出了十分详细的IP地址，下载安装后，打开软件，点击解压就可以获取到txt文本格式的IP地址
http://www.crsky.com/soft/2611.html
IP转换为acl工具下载地址
http://blog.lishixin.net/linux/468.html/attachment/dnstool
按照下面博客中的步骤将IP转换为acl格式
http://blog.lishixin.net/archives/468#more-468
注意事项：
只要配置了view的时候，所有的zone都必须包含到view中。
包括下面的这两行
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
下面是本配置中需要的，只列出部分IP的acl文件，这个不影响正常使用
mkdir -p /var/named/acl/srcip/
vim /var/named/acl/srcip/AnHui.acl
acl "AnHui.cnc"{
36.32.0.0/;
36.32.1.0/;
36.32.2.0/;
};
acl "AnHui.telcom"{
36.4.0.0/;
36.4.1.0/;
36.4.2.0/;
};
acl "AnHui.tietong"{
61.235.36.0/;
61.235.37.0/;
61.235.38.0/;
};
acl "AnHui.mobile"{
101.36.128.0/;
101.36.129.0/;
101.36.130.0/;
};
acl "AnHui.cernet"{
1.51.64.0/;
1.51.65.0/;
1.51.100.0/;
};
vim /var/named/acl/srcip/BeiJing.acl
acl "BeiJing.cnc"{
1.25.36.67;
1.25.36.68;
1.25.36.69;
};
acl "BeiJing.telcom"{
1.92.0.0/;
1.93.0.0;
1.93.0.1;
};
acl "BeiJing.tietong"{
36.192.0.0/;
36.192.1.0/;
36.192.2.0/;
};
acl "BeiJing.mobile"{
36.128.0.0/;
36.129.0.0/;
36.130.0.0/;
};
acl "BeiJing.cernet"{
42.247.0.128;
42.247.0.129;
42.247.0.130;
};
主DNS服务器配置，named.conf，修改后需要重启service named restart
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// include "/var/named/acl/srcip/AnHui.acl";
include "/var/named/acl/srcip/BeiJing.acl"; //include "/var/named/include_acl"; options {
listen-on port { 127.0.0.1; 192.168.1.100; }; //主DNS服务器
listen-on-v6 port { ::; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; 192.168.1.0/; };
allow-transfer { localhost; 192.168.1.101; }; //从DNS服务器
allow-query-cache { any; }; //注意没有这个将无法访问网页
recursion yes; dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto; /* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic";
}; logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
}; //电信
view "telcom-view" {
match-clients {
AnHui.telcom;
BeiJing.telcom;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type master;
file "forward.unixmen"; //正向解析文件名
allow-update { none; };
};
zone"1.168.192.in-addr.arpa" IN {
type master;
file "reverse.unixmen";//反向解析文件名
allow-update { none; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //联通
view "cnc-view" {
match-clients {
AnHui.cnc;
BeiJing.cnc;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type master;
file "forward.unixmen"; //正向解析文件名
allow-update { none; };
};
zone"1.168.192.in-addr.arpa" IN {
type master;
file "reverse.unixmen";//反向解析文件名
allow-update { none; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //移动
view "mobile-view" {
match-clients {
AnHui.mobile;
BeiJing.mobile;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type master;
file "forward.unixmen"; //正向解析文件名
allow-update { none; };
};
zone"1.168.192.in-addr.arpa" IN {
type master;
file "reverse.unixmen";//反向解析文件名
allow-update { none; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //中国教育与科研网
view "cernet-view" {
match-clients {
AnHui.cernet;
BeiJing.cernet;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type master;
file "forward.unixmen"; //正向解析文件名
allow-update { none; };
};
zone"1.168.192.in-addr.arpa" IN {
type master;
file "reverse.unixmen";//反向解析文件名
allow-update { none; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; view "external-view" {
match-clients { any; };
recursion yes; //需要递归，要不然上不了网。。。 zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type master;
file "forward.unixmen"; //正向解析文件名
allow-update { none; };
};
zone"1.168.192.in-addr.arpa" IN {
type master;
file "reverse.unixmen";//反向解析文件名
allow-update { none; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; key "rndc-key" {
algorithm hmac-md5;
secret "VcL5wC2GHCzCU7ju+ajC1Q==";
}; controls {
inet 0.0.0.0 port
allow { localhost; 192.168.1.101; } keys { "rndc-key"; };
};
从DNS服务器named.conf配置,修改后需要重启service named restart
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// include "/var/named/acl/srcip/AnHui.acl";
include "/var/named/acl/srcip/BeiJing.acl"; options {
listen-on port { 127.0.0.1;192.168.1.101; };
listen-on-v6 port { ::; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; };
allow-query-cache { any; };//注意没有这个将无法访问网页
recursion yes; dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto; /* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic";
}; logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
}; //电信
view "telcom-view" {
match-clients {
AnHui.telcom;
BeiJing.telcom;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type slave;
file "slaves/unixmen.fwd";
masters { 192.168.1.100; };#主DNS
}; zone"1.168.192.in-addr.arpa" IN {
type slave;
file "slaves/unixmen.rev";
masters { 192.168.1.100; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //联通
view "cnc-view" {
match-clients {
AnHui.cnc;
BeiJing.cnc;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type slave;
file "slaves/unixmen.fwd";
masters { 192.168.1.100; };#主DNS
}; zone"1.168.192.in-addr.arpa" IN {
type slave;
file "slaves/unixmen.rev";
masters { 192.168.1.100; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //移动
view "mobile-view" {
match-clients {
AnHui.mobile;
BeiJing.mobile;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type slave;
file "slaves/unixmen.fwd";
masters { 192.168.1.100; };#主DNS
}; zone"1.168.192.in-addr.arpa" IN {
type slave;
file "slaves/unixmen.rev";
masters { 192.168.1.100; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; //中国教育与科研网
view "cernet-view" {
match-clients {
AnHui.cernet;
BeiJing.cernet;
}; zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type slave;
file "slaves/unixmen.fwd";
masters { 192.168.1.100; };#主DNS
}; zone"1.168.192.in-addr.arpa" IN {
type slave;
file "slaves/unixmen.rev";
masters { 192.168.1.100; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; view "external-view" {
match-clients { any; };
recursion yes; //需要递归，要不然上不了网。。。 zone "." IN {
type hint;
file "named.ca";
}; zone"unixmen.local" IN {
type slave;
file "slaves/unixmen.fwd";
masters { 192.168.1.100; };#主DNS
}; zone"1.168.192.in-addr.arpa" IN {
type slave;
file "slaves/unixmen.rev";
masters { 192.168.1.100; };
}; include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
}; key "rndc-key" {
algorithm hmac-md5;
secret "VcL5wC2GHCzCU7ju+ajC1Q==";
}; controls {
inet * port
allow { 127.0.0.1;192.168.1.100; } keys { "rndc-key"; };
};
使用BIND安装智能DNS服务器（三）---添加view和acl配置的更多相关文章
- 使用BIND安装智能DNS服务器（一）---基本的主从DNS服务器搭建
参考网址:http://www.unixmen.com/dns-server-installation-step-by-step-using-centos-6-3/ DNS(Domain Name S ...
- 使用BIND安装智能DNS服务器（二）---配置rndc远程控制
首先两个BIND DNS服务器要正常运行. 主DNS服务器IP:192.168.1.100 客户机DNS服务器IP:192.168.1.101 1 主DNS端配置: cd /etc/ 生成 ...
- 使用bind实现主从DNS服务器数据同步
一.bind简介 Linux中通常使用bind来实现DNS服务器的架设,bind软件由isc(www.isc.org)维护.在yum仓库中可以找到软件,配置好yum源,直接使用命令yum instal ...
- Bind 远程连接DNS服务器时出现 rndc: connection to remote host closed
使用命令:rndc -s 192.168.1.2 status 连接远程的bind 搭建的DNS服务器时出现下面的错误: rndc: connection to remote host close ...
- Linux DNS分离解析与构建智能DNS服务器
一 构建DNS分离解析 方法一 : [root@localhost ~]# vim /etc/named.conf [root@localhost ~]# cd /var/named/ [root@l ...
- linux下DNS服务器搭建，正反向解析配置
dns服务器之前自己搭建玩过,一段时间不搞,加上当时没写文档,基本忘光光了,这次老实了,写个文档记下来,方便以后查阅. 1.服务器准备 为了避免不必要的问题,关闭防火墙,关闭selinux,hosts ...
- 在 CentOS7.0 上搭建 Chroot 的 Bind DNS 服务器
BIND(Berkeley internet Name Daemon)也叫做NAMED,是现今互联网上使用最为广泛的DNS 服务器程序.这篇文章将要讲述如何在 chroot 监牢中运行 BIND,这样 ...
- 【转】在CentOS 8 / RHEL 8上配置主/从BIND DNS服务器
转自: https://zh.codepre.com/centos-2700.html 前言 本指南描述了在CentOS 8 / RHEL 8 Linux上配置BIND DNS服务器所需的步骤.在Ce ...
- 2-7-搭建DNS服务器实现域名解析
学习服务的方法: 了解服务的作用:名称,功能,特点 安装服务 配置文件的位置,端口 服务开启和关闭的脚本 修改配置文件(实战举例) 排错(从上到下,从内到外) -------------------- ...
随机推荐
- rtmp直播拉流客户端EasyRTMPClient设计过程中时间戳问题汇总
EasyRTMPClient 简介 EasyRTMPClient是EasyDarwin流媒体团队开发.提供的一套非常稳定.易用.支持重连接的RTMPClient工具,以SDK形式提供,接口调用非常简单 ...
- detached HEAD state
1 detached HEAD state指的是什么 正常情况下,HEAD指向一个branch,而branch又指向一个commit. detached HEAD state指的是HEAD指针没有指向 ...
- 点聚-weboffice 6.0 (二)
1.修订操作 //设置当前操作用户 function SetUserName() { try{ var webObj=document.getElementById("WebOffice1& ...
- Swift 学习笔记 (方法)
方法 是关联了特定类型的函数.类,结构体以及枚举都能定义实例方法,方法封装了给定类型特定的任务和功能.类,结构体和枚举同样可以定义类型方法,这是与类型本身关联的方法.类型方法与 Objective-C ...
- python数据分析之：数据加载，存储与文件格式
前面介绍了numpy和pandas的数据计算功能．但是这些数据都是我们自己手动输入构造的．如果不能将数据自动导入到python中,那么这些计算也没有什么意义．这一章将介绍数据如何加载以及存储． 首先来 ...
- 线程池ThreadPoolExcecutor介绍
线程池ThreadPoolExecutor 使用Executors和ThreadPoolExecutor 并发新特性—Executor 框架与线程池
- 多线程(一) NSThread
OS中多线程的实现方案: 技术 语言 线程生命周期 使用频率 pthread C 程序员自行管理 几乎不用 NSthread OC 程序员自行管理 偶尔使用 GCD C 自动管理 经常使用 NSOpe ...
- hashMap的线程不安全
hashMap是非线程安全的,表现在两种情况下: 1 扩容: t1线程对map进行扩容,此时t2线程来读取数据,原本要读取位置为2的元素,扩容后此元素位置未必是2,则出现读取错误数据. 2 hash碰 ...
- 获取HDC的几种方法
当需要在显示器上(当然包括打印机等设备上)绘图时,或者写文字的时候,需要取得设备的上下文句柄,即HDC,本文以下都称为HDC.那么,有哪些办法取得HDC呢? 1 BeginPain()和EndPain ...
- debian7 amd64版本添加对x86包的支持
dpkg --add-architecture i386apt-get updateapt-get install ia32-libs ia32-libs-gtk