DNS转发的两种模式

原创

Masuri 2019-04-26 08:53:20 ©著作权

©著作权归作者所有：来自51CTO博客作者Masuri的原创作品，请联系作者获取转载授权，否则将追究法律责任

DNS转发

dns转发分为2种，全局转发和特定区域转发
全局转发是对非本机所负责解析区域的请求，全部转发给指定的服务器
特定区域转发是仅转发对特定的区域的请求，比全局转发优先级高
而转发又分为2种模式：first和only

一、测试：全局转发的only模式

准备客户机一台，dns服务器两台，将dns1服务器的转发地址者设置为dns2，dns1有两个网卡一个是内网，一个是外网，dns2只有一个连接内网的网卡

主机	ip
client	192.168.73.120
dns1	192.168.73.10 172.22.145.220
dns2	192.168.73.30

分别在dns1、dns2上配置dns服务
在dns2上部署配置dns

[root@dns2 ~]# yum install bind -y
[root@dns2 ~]# vim /etc/named.conf 
options {
//      listen-on port 53 { 127.0.0.1; };       #此行注释
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
//      allow-query     { localhost; };         #此行注释

dns2启动服务

[root@dns2 ~]# systemctl start named

dns1主机上部署dns服务并设置dns转发，转发模式为only

options {
//      listen-on port 53 { 127.0.0.1; };           #注释
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
//      allow-query     { localhost; };             #注释
        forward         only;                       #转发模式设置为only
        forwarders      {192.168.73.30;};           #转发地址设置为dns2主机

        dnssec-enable no;                           #设置转发时需要关闭dnssec相关

        dnssec-validation no;                       #设置转发时需要关闭dnssec相关

在client主机上去解析www.baidu.com

[root@centos7 ~]# dig www.baidu.com @192.168.192.10

; <<>> DiG 9.9.4-RedHat-9.9.4-72.el7 <<>> www.baidu.com @192.168.192.10
;; global options: +cmd
;; connection timed out; no servers could be reached

转发模式为only的情况下，无法解析到www.baidu.com的地址。

二、测试：全局转发的first模式

将dns1设置为first模式下的转发

[root@dns1 ~]# vim /etc/named.conf 
options {
//      listen-on port 53 { 127.0.0.1; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
//      allow-query     { localhost; };
        forward         first;                  #修改为first
        forwarders      {192.168.73.30;};

重读配置文件

[root@dns1 ~]# rndc reload
server reload successful

在client上进行测试

[root@centos7 ~]# dig www.baidu.com @192.168.73.10

; <<>> DiG 9.9.4-RedHat-9.9.4-72.el7 <<>> www.baidu.com @192.168.73.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44783
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 5, ADDITIONAL: 6

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.baidu.com.			IN	A

;; ANSWER SECTION:
www.baidu.com.		1200	IN	CNAME	www.a.shifen.com.
www.a.shifen.com.	300	IN	A	61.135.169.121
www.a.shifen.com.	300	IN	A	61.135.169.125

;; AUTHORITY SECTION:
a.shifen.com.		1199	IN	NS	ns2.a.shifen.com.
a.shifen.com.		1199	IN	NS	ns5.a.shifen.com.
a.shifen.com.		1199	IN	NS	ns4.a.shifen.com.
a.shifen.com.		1199	IN	NS	ns3.a.shifen.com.
a.shifen.com.		1199	IN	NS	ns1.a.shifen.com.

;; ADDITIONAL SECTION:
ns1.a.shifen.com.	1199	IN	A	61.135.165.224
ns2.a.shifen.com.	1199	IN	A	220.181.57.142
ns3.a.shifen.com.	1199	IN	A	112.80.255.253
ns4.a.shifen.com.	1199	IN	A	14.215.177.229
ns5.a.shifen.com.	1199	IN	A	180.76.76.95

;; Query time: 2835 msec
;; SERVER: 192.168.73.10#53(192.168.73.10)
;; WHEN: Tue Apr 23 23:30:16 CST 2019
;; MSG SIZE  rcvd: 271

此时服务器返回的为dns1从网络上其他dns所解析到的地址