用bind9构架自动根据来源ip动态解析的智能主、辅DNS

 

用bind9构架自动根据来源ip动态解析的智能主、辅DNS

由于各运营商之间网络连接的瓶颈问题，使得处于某一网络的用户在访问位于其他网络的服务器时，速度慢的令人难以忍受，不得已我们采取了在不同运营商处分别放置服务器的方式来解决，原来已经介绍过，可以通过cache来比较方便的解决不同服务器内容同步问题，这次主要介绍如何通过动态智能DNS，来将用户自动导向速度快的服务器。
以下我们通过一个实例来说明如何实现动态解析域名。例如，我们在教育网和网通分别有一台具有相同内容的服务器，cache1.test.com（202.194.15.22）和cache2.test.com（218.56.57.125）。我们要做的就是使用户通过域名www.sdada.edu.cn访问时，根据用户使用的网络，将用户动态分配到速度快的服务器上。（原来可能使用过www1和www2分别指向的方式，但毕竟不方便。）
我们有两台DNS服务器，主DNS(MASTER):202.194.15.1,辅DNS(SLAVE):202.194.15.2，202.194.15.3。实际上，动态解析的工作是通过bind9的view功能来实现的，这里为了省事，主辅DNS都安装redhat as4，使用其自带的bind9.2.4，我们主要学习如何设置bind view。
辅DNS的数据都来源于主DNS，若我们使用了view功能，那么辅DNS使用常规设置，就只能获取到某一view的内容，不能同步所有的view，所以我们给辅dns设置了两个ip地址，通过在主DNS上设置view的选择功能，以及在辅DNS上设置transfer-source，即使用哪个ip同步功能来实现多个view的同步。
首先明确一下我们要实现的目标，即网通用户访问www.sdada.edu.cn自动导向cache2，其他网络用户访问www.sdada.edu.cn自动导向cache1。要识别是否为网通用户，我们需要有一个网通网络的ip地址列表，这个可以从网上找到。放到acl.conf文件中，并将acl.conf复制到主、辅DNS的/var/named/chroot/var/named目录中（目录视具体情况而定）。
acl.conf
//cnc acl list
acl ///"CNC///" {
58.16.0.0/16;
58.17.0.0/17;
58.17.128.0/17;
58.18.0.0/16;
58.19.0.0/16;
58.20.0.0/16;
58.21.0.0/16;
58.22.0.0/15;
58.240.0.0/15;
58.242.0.0/15;
58.244.0.0/15;
58.246.0.0/15;
58.248.0.0/13;
60.0.0.0/13;
60.8.0.0/15;
60.10.0.0/16;
60.11.0.0/16;
60.12.0.0/16;
60.13.0.0/18;
60.13.128.0/17;
60.14.0.0/15;
60.16.0.0/13;
60.24.0.0/14;
60.30.0.0/16;
60.31.0.0/16;
60.208.0.0/13;
60.216.0.0/15;
60.218.0.0/15;
60.220.0.0/14;
61.48.0.0/13;
61.133.0.0/17;
61.134.96.0/19;
61.134.128.0/17;
61.135.0.0/16;
61.137.128.0/17;
61.138.0.0/17;
61.138.128.0/18;
61.139.128.0/18;
61.148.0.0/15;
61.156.0.0/16;
61.158.0.0/16;
61.159.0.0/18;
61.161.0.0/18;
61.161.128.0/17;
61.162.0.0/16;
61.163.0.0/16;
61.167.0.0/16;
61.168.0.0/16;
61.176.0.0/16;
61.179.0.0/16;
61.180.128.0/17;
61.181.0.0/16;
61.182.0.0/16;
61.189.0.0/17;
125.32.0.0/16;
125.40.0.0/13;
202.96.0.0/18;
202.96.64.0/21;
202.96.72.0/21;
202.97.128.0/18;
202.97.224.0/21;
202.97.240.0/20;
202.98.0.0/21;
202.98.8.0/21;
202.99.64.0/19;
202.99.96.0/21;
202.99.128.0/19;
202.99.160.0/21;
202.99.168.0/21;
202.99.176.0/20;
202.99.208.0/20;
202.99.224.0/21;
202.99.232.0/21;
202.99.240.0/20;
202.102.128.0/21;
202.102.224.0/21;
202.102.232.0/21;
202.106.0.0/16;
202.107.0.0/17;
202.108.0.0/16;
202.110.0.0/17;
202.111.128.0/18;
203.93.8.0/24;
203.93.192.0/18;
210.13.128.0/17;
210.14.160.0/19;
210.14.192.0/19;
210.15.32.0/19;
210.15.96.0/19;
210.15.128.0/18;
210.16.128.0/18;
210.21.0.0/16;
210.51.0.0/16;
210.52.128.0/17;
210.53.0.0/17;
210.53.128.0/17;
210.74.96.0/19;
210.74.128.0/19;
210.82.0.0/15;
211.152.0.0/13;
218.7.0.0/16;
218.8.0.0/14;
218.12.0.0/16;
218.21.128.0/17;
218.24.0.0/14;
218.28.0.0/15;
218.56.0.0/14;
218.60.0.0/15;
218.62.0.0/17;
218.67.128.0/17;
218.68.0.0/15;
218.104.0.0/14;
219.154.0.0/15;
219.156.0.0/15;
219.158.0.0/17;
219.158.128.0/17;
219.159.0.0/18;
220.252.0.0/16;
221.0.0.0/15;
221.2.0.0/16;
221.3.0.0/17;
221.3.128.0/17;
221.4.0.0/16;
221.5.0.0/17;
221.5.128.0/17;
221.6.0.0/16;
221.7.0.0/19;
221.7.32.0/19;
221.7.64.0/19;
221.7.96.0/19;
221.7.128.0/17;
221.8.0.0/15;
221.10.0.0/16;
221.11.0.0/17;
221.11.128.0/18;
221.11.192.0/19;
221.12.0.0/17;
221.12.128.0/18;
221.13.0.0/18;
221.13.64.0/19;
221.13.96.0/19;
221.13.128.0/17;
221.14.0.0/15;
221.192.0.0/15;
221.194.0.0/16;
221.195.0.0/16;
221.196.0.0/15;
221.198.0.0/16;
221.199.0.0/19;
221.199.32.0/20;
221.199.128.0/18;
221.199.192.0/20;
221.200.0.0/14;
221.204.0.0/15;
221.206.0.0/16;
221.207.0.0/18;
221.207.64.0/18;
221.207.128.0/17;
221.208.0.0/14;
221.212.0.0/16;
221.213.0.0/16;
221.214.0.0/16;
221.215.0.0/16;
221.216.0.0/13;
222.128.0.0/14;
222.132.0.0/14;
222.136.0.0/13;
222.160.0.0/15;
222.162.0.0/16;
222.163.0.0/19;
222.163.32.0/19;
222.163.64.0/18;
222.163.128.0/17;
219.235.56.194;
};
然后，我们需要在主DNS的named.conf中设置view，以及添加区域，如下
named.conf

//
// named.conf for Red Hat caching-nameserver
//
options {
directory ///"/var/named///"; //设置工作目录
dump-file ///"/var/named/data/cache_dump.db///";
statistics-file ///"/var/named/data/named_stats.txt///";
/*
* If there is a firewall between you and nameservers you want
* to talk to, you might need to uncomment the query-source
* directive below. Previous versions of BIND always asked
* questions using port 53, but BIND 8.1 uses an unprivileged
* port by default.
*/
// query-source address * port 53;
};
//
// a caching only nameserver config
//
controls {
inet 127.0.0.1 allow { localhost; } keys { rndckey; };
};
zone ///".///" IN { //设置查询根服务器
type hint;
file ///"named.ca///";
};
zone ///"localdomain///" IN {
type master;
file ///"localdomain.zone///";
allow-update { none; };
};
zone ///"localhost///" IN {
type master;
file ///"localhost.zone///";
allow-update { none; };
};
zo
4000
ne ///"0.0.127.in-addr.arpa///" IN {
type master;
file ///"named.local///";
allow-update { none; };
};
zone ///"0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa///" IN {
type master;
file ///"named.ip6.local///";
allow-update { none; };
};
zone ///"255.in-addr.arpa///" IN {
type master;
file ///"named.broadcast///";
allow-update { none; };
};
zone ///"0.in-addr.arpa///" IN {
type master;
file ///"named.zero///";
allow-update { none; };
};
include ///"/etc/rndc.key///";
include ///"/var/named/acl.conf///"; //包含acl.conf
view ///"view_cnc///" {
match-clients { CNC;202.194.15.3; }; //view cnc使用202.194.15.3来传输
zone ///"sdada.edu.cn///" {
type master;
file ///"/var/named/cnc.sdada.edu.cn.hosts///";
allow-transfer { 202.194.15.3; };
};
};
view ///"view_any///" { //view any使用202.194.15.2来传输
match-clients { any; };
zone ///"sdada.edu.cn///" {
type master;
file ///"/var/named/edu.sdada.edu.cn.hosts///";
allow-transfer { 202.194.15.2; };
};
};
然后我们分别设置cnc.sdada.edu.cn.hosts和edu.sdada.edu.cn.hosts这两个记录文件。
cnc.sdada.edu.cn.hosts
$ttl 38400
sdada.edu.cn. IN SOA dns1.sdada.edu.cn. admin.sdada.edu.cn. (
1160617933
10800
3600
604800
38400 )
sdada.edu.cn. IN NS dns1.sdada.edu.cn.
sdada.edu.cn. IN NS dns2.sdada.edu.cn.
@ A 218.56.57.125
@ MX 10 mail.sdada.edu.cn.
mail A 192.168.0.11
www A 218.56.57.125
edu.sdada.edu.cn.hosts
$ttl 38400
sdada.edu.cn. IN SOA dns1.sdada.edu.cn. admin.sdada.edu.cn. (
1160561482
10800
3600
604800
38400 )
sdada.edu.cn. IN NS dns1.sdada.edu.cn.
sdada.edu.cn. IN NS dns2.sdada.edu.cn.
@ A 202.194.15.22
@ MX 10 mail.sdada.edu.cn.
mail A 192.168.0.11
www A 202.194.15.22
这样，重新启动Bind后,主DNS就生效了，网通用户输入www.sdada.edu.cn会自动访问218.56.57.125,而其他用户会访问202.194.15.22,我们还可以根据需要添加反向解析区域，这里不再作介绍。
然后需要设置辅助DNS，
辅助DNS只需要设置named.conf指定master，无须设置记录文件，它会从master自动同步。
named.conf
//
// named.conf for Red Hat caching-nameserver
//
options {
directory /"/var/named/";
dump-file /"/var/named/data/cache_dump.db/";
statistics-file /"/var/named/data/named_stats.txt/";
/*
* If there is a firewall between you and nameservers you want
* to talk to, you might need to uncomment the query-source
* directive below. Previous versions of BIND always asked
* questions using port 53, but BIND 8.1 uses an unprivileged
* port by default.
*/
// query-source address * port 53;
};
//
// a caching only nameserver config
//
controls {
inet 127.0.0.1 allow { localhost; } keys { rndckey; };
};
zone /"./" IN {
type hint;
file /"named.ca/";
};
zone /"localdomain/" IN {
type master;
file /"localdomain.zone/";
allow-update { none; };
};
zone /"localhost/" IN {
type master;
file /"localhost.zone/";
allow-update { none; };
};
zone /"0.0.127.in-addr.arpa/" IN {
type master;
file /"named.local/";
allow-update { none; };
};
zone /"0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/" IN {
type master;
file /"named.ip6.local/";
allow-update { none; };
};
zone /"255.in-addr.arpa/" IN {
type master;
file /"named.broadcast/";
allow-update { none; };
};
zone /"0.in-addr.arpa/" IN {
type master;
file /"named.zero/";
allow-update { none; };
};
include /"/etc/rndc.key/";
include /"/var/named/acl.conf/"; //包含acl.conf
server 202.194.15.1 {
};
view view_cnc {
match-clients {
cnc;
};
zone /"sdada.edu.cn/" {
type slave;
masters {
202.194.15.1;
};
file /"/var/named/slaves/sdada.edu.cn.view_cnc.hosts/";
transfer-source 202.194.15.3; //view cnc使用202.194.15.3同步
};
};
view view_any {
match-clients {
any;
};
zone /"sdada.edu.cn/" {
type slave;
masters {
202.194.15.1;
};
file /"/var/named/slaves/sdada.edu.cn.view_any.hosts/";
transfer-source 202.194.15.2; //view any使用202.194.15.2同步
};
};

设置完成后重启辅dns的Bind,很快就可以看到辅助dns已经分别同步到不同View的内容了。
我们可以分别在网通网和教育网上使用nslookup - 202.194.15.1和nslookup - 202.194.15.2分别测试两个DNS服务器的工作情况。