Tutorial on building a DNS server on CentOS and building a dns on centos

Tutorial on building a DNS server on CentOS and building a dns on centos

1. Install software

Common DNS server software includes BIND, NSD, Unbound, etc. While BIND has the highest market share, the last two are lightweight and fast DNS servers. Here I use BIND, and others are similar.

Switch to the root user on centos (all the following operations are performed on the root user) and run yum install bind dind-devel-y to install the software.

After installation is complete, configure.

Ii. Configuration

1. edit/etc/named. conf

Modify the following two rows, as shown in ),

Listen-on port 53 {127.0.0.1 ;};

# Change 127.0.0.1 to the actual IP address of the cost machine or any

Allow-query {localhost ;};

# Convert localhost to any

The modification is as follows:

2. Configure the domain name resolution File

Domain name resolution is divided into forward and reverse regions. The forward region is the process of resolving a domain name into an IP address, and the reverse region is the client searching for its domain name based on the IP address of a computer. In most DNS queries, the client generally performs forward region resolution.

The configuration of the forward and reverse regions can be directly written in/etc/named. conf (not recommended), in/etc/named. there are two include statements at the bottom of conf, including "/etc/named. rfc1912.zones "; it is the file used to configure the forward and reverse regions. Of course, it can also be customized. conf include), in.

Here we use the default configuration file/etc/named. rfc1912.zones to execute

Vim/etc/named. rfc1912.zones

Edit this file and add it to the file (the author takes the domain name 3jhx. cc as an example ):

Zone "3jhx. cc" IN {

Type master;

File "3jhx. cc. zone ";

};

This is the forward resolution area,

The reverse region is shown as follows,

Zone "1.168.192.in-addr. arpa." IN {

Type master;

File "1.168.192.zone ";

};

The files in the forward and reverse parsing regions are all configured in the directory parameter of/etc/named. conf. The default value is "/var/named ".

Edit the forward region file. The content is shown in the following figure: ns1 and NS2. it is the two DNS domain names to be resolved and used when we customize the domain name DNS server.

The two parameters behind SOA are the Master DNS server host name and administrator mailbox (root@3jhx.cc), respectively ). Because the @ symbol has a special meaning, it is written as this. Pay attention to the point at the end.

The first parameter in the brackets is the serial number, which indicates the New and Old parameters in this configuration document. The larger the serial number, the newer the parameter. This value must be increased every time this document is modified.

The second parameter is the refresh frequency, indicating the interval between the slave and the master to compare the configuration file. The unit is second (used in the master-slave DNS architecture ).

The third parameter is the failed retry time, in seconds.

The fourth parameter is the expiration time, in seconds.

The fifth parameter indicates the time when other DNS servers can cache negative answers, in seconds.

The above seven parameters can be written in the graph or in seconds. The two parameters are the same.

; Type NS defines the DNS server host name of the specified domain. Here are ns1.3jhx. cc and ns2.3jhx. cc.

The A record is the ing between the domain name and IP address. If the IP address is IPV6, the record is AAAA.

Save the configuration.

Example of reverse region file Configuration:

3. Restart the named service.

CentOS6.x uses service named restart to restart the named service, and uses chkconfig named on to start the service at startup.

CentOS7.x use systemctl restart named to restart the named service and useSystemctl enable namedStart the service.

4. configure the firewall

Open port 53 of the firewall. Note that TCP and UDP ports 53 must be enabled at the same time. For ECS instances, open TCP and UDP ports 53 of the Security Group.

CentOS7.x is:

[Root @ localhost ~] #Firewall-cmd -- zone = public -- add-port = 53/tcp -- permanent

[Root @ localhost ~] #Firewall-cmd -- zone = public -- add-port = 53/udp -- permanent

Restart the firewall to make the change take effect immediately:

[Root @ localhost ~] #Firewall-cmd-reload

Run the following command to check whether the configuration is successful:

[Root @ localhost ~] #Firewall-cmd -- list-all

CentOS6.X is:

/Sbin/iptables-I INPUT-p tcp -- dport53-j ACCEPT

/Sbin/iptables-I INPUT-p udp -- dport53-j ACCEPT

Save rule:

/Etc/rc. d/init. d/iptables save

Restart the firewall to make the change take effect immediately:

Service iptables restart

Iii. Verification

To verify that the dns we configured is correct, manually change the DNS server address on the client computer to the DNS server address we configured, and then run the nslookup command or the dig command to test

In Linux, enter the nslookup command on the terminal, and in windows, enter the nslookup command on the cmd command line.

4. configure a custom DNS Server

In order to ensure the authenticity of the experiment, I use the real domain name experiment here.

Go to the domain name management console. I use hichina, similar to other service providers.

Create two DNS servers ns1.3jhx. cc and ns2.3jhx. cc on the custom DNS Server Page

After the creation is complete, the NS and A records must be resolved on our DNS server. We have resolved the records above.

Click DNS modification to change the DNS of the domain name to the two newly created DNS addresses (why are there two, at least two international domain names, and a maximum of 13)

It takes some time for the modification to take effect.

Now we can use the DNS server we created to resolve our domain name.

Note: In my experiment, I did not create a slave DNS server, but only the primary DNS server. The creation of the slave DNS server is similar to that of the primary DNS server. in actual application, the master-slave structure is required.