[네임서버] dns 포워딩(bind dns forwarding)

dns 포워딩(bind dns forwarding)

- 도메인 질의에 대한 처리를 해당 DNS 서버에서 하지 않고 특정 DNS 서버로 전달하는 방식

 

문법

[ forward ( only | first ); ]
[ forwarders { [ ip_addr [port ip_port] ; ... ] }; ]

// first : 외부 질의를 할때 우선 포워더를 참조해보고 전부 실패할 경우 직접 처리.

// only : 포워더가 전부 실패해도 직접 처리하지 않음.

 

[옵션 구문]

options {
    ...(생략)
    forward only;
    // forward to external servers
    forwarders {
    bastion-ips-go-here;
    ...(생략)
};

 

[도메인 구문]

zone zone_name [class] {
    type forward;
    [ forward (only|first) ; ]
    [ forwarders { [ ip_addr [port ip_port] ; ... ] }; ]
};

** forwarders에 여러 개의 DNS IP 입력한다고해서 1차 2차 구조로 되는것이 아니라 응답속도가 빠른 곳으로 질의를 한다

 

dns 포워딩 설정

named 설정 파일(named.conf)

• allow-query-cache { any; };
• forwarders { 8.8.8.8; 1.1.1.1; };
• forward only;
• recursion yes;

vim /etc/named.conf

$ cat /etc/named.conf
// named.conf
options {
	listen-on port 53 { any; };
	directory "/var/named";
	dump-file "/var/named/data/cache_dump.db";
	statistics-file "/var/named/data/named_stats.txt";
	memstatistics-file "/var/named/data/named_mem_stats.txt";
	recursing-file "/var/named/data/named.recursing";
	secroots-file "/var/named/data/named.secroots";
	version "UNKNOWN";
	allow-query { any; };
	allow-query-cache { any; };

	forwarders { 8.8.8.8; 1.1.1.1; };
	forward only;

	recursion yes;
	recursive-clients 10000;

	check-names master ignore;
	check-names slave ignore;
	check-names response ignore;

	zone-statistics yes;

	dnssec-enable yes;
	dnssec-validation yes;

	/* Path to ISC DLV key */
	bindkeys-file "/etc/named.root.key";

	managed-keys-directory "/var/named/dynamic";

	pid-file "/run/named/named.pid";
	session-keyfile "/run/named/session.key";

};

statistics-channels {
	inet 192.168.0.62 port 7777 allow { 192.168.0.0/24; };
};

include "/etc/named.root.key";
include "/etc/named.rfc1912.zones";
include "/etc/named.logging.conf";

 

vim /etc/named.rfc1912.zones

$ cat /etc/named.rfc1912.zones
// named.rfc1912.zones:
// See /usr/share/doc/bind*/sample/ for example named configuration files.
zone "." IN {
	type hint;
	file "named.ca";
};

zone "localhost" IN {
	type master;
	file "named.localhost";
	allow-update { none; };
};

zone "1.0.0.127.in-addr.arpa" IN {
	type master;
	file "named.loopback";
	allow-update { none; };
};