案例
背景:公司内部访问自己的公司的web站点时,给他解析出内部的IP,而外部的主机访问我们的DNS时,将公司的站点解析出公网地址。
环境:二台主机,一台防火墙
拓扑图:
![DNS视图_dns视图](https://s2.51cto.com/attachment/201304/000423381.png?x-oss-process=image/resize,m_fixed,w_1184)
实验步骤:
1、安装DNS服务器
![DNS视图_dns视图_02](https://s2.51cto.com/attachment/201304/000436163.png?x-oss-process=image/resize,m_fixed,w_1184)
2、配置DNS服务器
![DNS视图_DNS_03](https://s2.51cto.com/attachment/201304/000450609.png?x-oss-process=image/resize,m_fixed,w_1184)
创建区域
![DNS视图_DNS_04](https://s2.51cto.com/attachment/201304/000500330.png?x-oss-process=image/resize,m_fixed,w_1184)
![DNS视图_DNS_05](https://s2.51cto.com/attachment/201304/000516693.png?x-oss-process=image/resize,m_fixed,w_1184)
![DNS视图_dns视图_06](https://s2.51cto.com/attachment/201304/000529766.png?x-oss-process=image/resize,m_fixed,w_1184)
![DNS视图_dns视图_07](https://s2.51cto.com/attachment/201304/000542163.png?x-oss-process=image/resize,m_fixed,w_1184)
![DNS视图_DNS_08](https://s2.51cto.com/attachment/201304/000606150.png?x-oss-process=image/resize,m_fixed,w_1184)
3、添加区域记录
![DNS视图_dns视图_09](https://s2.51cto.com/attachment/201304/000618172.png?x-oss-process=image/resize,m_fixed,w_1184)
![DNS视图_dns视图_10](https://s2.51cto.com/attachment/201304/000628952.png?x-oss-process=image/resize,m_fixed,w_1184)
![DNS视图_DNS_11](https://s2.51cto.com/attachment/201304/000639540.png?x-oss-process=image/resize,m_fixed,w_1184)
![DNS视图_dns视图_12](https://s2.51cto.com/attachment/201304/000650636.png?x-oss-process=image/resize,m_fixed,w_1184)
![DNS视图_dns视图_13](https://s2.51cto.com/attachment/201304/000704577.png?x-oss-process=image/resize,m_fixed,w_1184)
4、配置防火墙
<H3C>dis cu
#
sysname H3C
#
firewall packet-filter enable
firewall packet-filter default permit
#
insulate
#
nat static inside ip 192.168.102.111 global ip 61.130.130.2
#
firewall statistic system enable
#
radius scheme system
server-type extended
#
domain system
#
local-user admin
password cipher .]@USE=B,53Q=^Q`MAF4<1!!
service-type telnet terminal
level 3
service-type ftp
#
interface Aux0
async mode flow
#
interface Ethernet0/0
ip address 192.168.102.254 255.255.255.0
#
interface Ethernet0/1
ip address 61.130.130.1 255.255.255.0
nat outbound static
#
interface Ethernet0/2
#
interface Ethernet0/3
#
interface Ethernet0/4
#
interface Encrypt1/0
#
interface NULL0
#
interface LoopBack0
ip address 1.1.1.1 255.255.255.255
#
firewall zone local
set priority 100
#
firewall zone trust
add interface Ethernet0/0
add interface Ethernet0/1
set priority 85
#
firewall zone untrust
set priority 5
#
firewall zone DMZ
set priority 50
#
firewall interzone local trust
#
firewall interzone local untrust
#
firewall interzone local DMZ
#
firewall interzone trust untrust
#
firewall interzone trust DMZ
#
firewall interzone DMZ untrust
#
FTP server enable
#
user-interface con 0
user-interface aux 0
user-interface vty 0 4
authentication-mode scheme
#
return
<H3C>
5、测试
内网测试
![DNS视图_dns视图_14](https://s2.51cto.com/attachment/201304/000720174.png?x-oss-process=image/resize,m_fixed,w_1184)
外网测试
![DNS视图_dns视图_15](https://s2.51cto.com/attachment/201304/000731785.png?x-oss-process=image/resize,m_fixed,w_1184)