海运的博客

Centos下用BIND配置主从同步智能DNS

发布时间:July 6, 2012 // 分类:DNS // No Comments

BIND可根据请求查询的源IP分配到不同的域规则,即智能DNS服务器
下载运营商IP地址库,定义ACL,由于条目太多,可分别存为独立文件调用。
示例主DNS为:1.1.1.1,从DNS为2.2.2.2。

#https://www.haiyun.me
acl liantong{
    112.96.0.0/15;
};

生成key,用于同步时验证并解决不能全部同步的问题,

dnssec-keygen -a hmac-md5 -b 128 -n HOST one
dnssec-keygen -a hmac-md5 -b 128 -n HOST two
dnssec-keygen -a hmac-md5 -b 128 -n HOST three

主DNS配置:

key one
{
       algorithm hmac-md5;
       secret "hxCQkylFHbhzbPYo+CRWLA==";
};
key two
{
       algorithm hmac-md5;
       secret "T4Gf+E0+3Y+5uL3ylkQBSA==";
};

key three
{
       algorithm hmac-md5;
       secret "8q22D8M1c9QQKJLteC2bQQ==";
};
view "dianxin" {
server  2.2.2.2 { 
        keys { one; };
};
match-clients { dianxin; key one; !key two; !key three};
zone "." IN {
        type hint;
        file "named.ca";
};
zone "www.haiyun.me" IN {
        type master;
        file "dianxin.www.haiyun.me";
        allow-query { any; };
        notify yes;
        allow-transfer { key one; };
        };
};

view "liantong" {
server  2.2.2.2 {
        keys { two; };
};
match-clients { liantong; key two; !key one; !key three; };
zone "." IN {
        type hint;
        file "named.ca";
};
zone "www.haiyun.me" IN {
        type master;
        file "liantong.www.haiyun.me";
        allow-query { any; };
        notify yes;
        allow-transfer { key two; };
        };
};

view "other" {
server  2.2.2.2 {
        keys { three; };
};
match-clients { any; key three; !key one; !key two; };
zone "." IN {
        type hint;
        file "named.ca";
};
zone "www.haiyun.me" IN {
        type master;
        file "other.www.haiyun.me";
        allow-query { any; };
        notify yes;
        allow-transfer { key three; };
        };
};
include "/var/named/dianxin.acl";
include "/var/named/liantong.acl";

从DNS配置:

key one
{
       algorithm hmac-md5;
       secret "hxCQkylFHbhzbPYo+CRWLA==";
};
key two
{
       algorithm hmac-md5;
       secret "T4Gf+E0+3Y+5uL3ylkQBSA==";
};

key three
{
       algorithm hmac-md5;
       secret "8q22D8M1c9QQKJLteC2bQQ==";
};
view "dianxin" {
server  1.1.1.1 {
        keys { one; };
};
match-clients { dianxin; key one; !key two; !key three; };
zone "." IN {
        type hint;
        file "named.ca";
};
zone "www.haiyun.me" IN {
        type master;
        file "dianxin.www.haiyun.me";
        allow-query { any; };
        masters {1.1.1.1;};
        };
};

view "liantong" {
server  1.1.1.1 {
        keys { two; };
};
match-clients { liantong; key two; !key one; !key three; };
zone "." IN {
        type hint;
        file "named.ca";
};
zone "www.haiyun.me" IN {
        type master;
        file "liantong.www.haiyun.me";
        allow-query { any; };
        masters {1.1.1.1;};
        };
};

view "other" {
server  1.1.1.1 {
        keys { three; };
};
match-clients { any; key three; !key one; !key two; };
zone "." IN {
        type hint;
        file "named.ca";
};
zone "www.haiyun.me" IN {
        type master;
        file "other.www.haiyun.me";
        allow-query { any; };
        masters {1.1.1.1;};
        };
};
include "/var/named/dianxin.acl";
include "/var/named/liantong.acl";

定义多个域规则,分别转向不同的IP:

$TTL 600
@                       IN SOA   ns1.www.haiyun.me. domain.mail.www.haiyun.me. (
                        2012070401;
                        3H;
                        10M;
                        1W;
                        1H );
@      IN     NS     ns1.www.haiyun.me.
ns1     IN     A     184.164.141.188
www     IN     A     184.164.141.188
分类
最新文章
最近回复
  • 1: 方法一ngtcp2要改下:./configure PKG_CONFIG_PATH=/usr/l...
  • 海运: 关闭服务器
  • 海风: override.battery.charge.low以及override.battery.r...
  • koldjf: 不能过滤
  • 杰迪武士: 此文甚好甚强巨,依照此文在树莓派2 + Rasbian上部署成功 感谢博主美文共赏
  • 海运: ups不知有没选项可设置此参数,不过你可以在另外一台电脑上安装nut客户端自动关机。
  • kgami: 想请教一下,设置了的电脑自动关机之后,几秒后UPS怎么也跟着关机了,导致另外一台电脑没关机就断...
  • 海运: 写的很详细了啊,/etc/nut/hosts.conf用以nut-cgi连接nut服务器参数,...
  • ryan: 请问下nginx配置好了,怎么和这个nut链接呢?最后可视化管理这块能给个详细一点的教程么?谢谢。
  • 1: /etc/config/fstab配置文件 https://openwrt.org/zh/do...