[root@localhost network-scripts]# cd ~
[root@localhost ~]# vim /etc/named.conf //进入比编辑主配置文件
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html
...//省略部分内容...
options {
listen-on port 53 { any; }; //更改为监听所有网卡，因为我们添加了另一块网卡，这样所有网卡就都可以通过来解析域名
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
allow-query { any; }; //更改为所有地址，这样所有网段就都可以使用DNS服务
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
...//省略部分内容...
：wq //保存退出
2、更改DNS服务区域配置文件
root@localhost ~]# vim /etc/named.rfc1912.zones
// named.rfc1912.zones:
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
//删除此处下所有条目，并在此处开始编写内容
zone "localhost.localdomain" IN {
type master;
file "named.localhost";
allow-update { none; };
};
zone "localhost" IN {
type master;
file "named.localhost";
allow-update { none; };
...//省略部分内容...
//
// Provided by Red Hat caching-nameserver package
//
// ISC BIND named zone configuration for zones recommended by
// RFC 1912 section 4.1 : localhost TLDs and address zones
// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt
// (c)2007 R W Franks
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
view "lan" { //设置对内局域网用户的区域结构
match-{ 192.168.100.0/24; }; //匹配条目来自局域网的客户端IP地址
zone "kgc.com" IN { //设置域名信息
type master; //区域类型为主区域
file "kgc.com.lan"; // 区域数据文件为“kgc.com.lan”
};
zone "." IN { //配置根域名解析（可以从主配置文件named.conf中复制即可）
type hint;
file "named.ca";
};
};
view "wan" { //设置面向广域网用户的区域结构
match-clients { 12.0.0.0/24; }; //匹配条目来自广域网的客户端IP地址
zone "kgc.com" IN {
type master;
file "kgc.com.wan"; // 区域数据文件为“kgc.com.wan”
};
};
~
~
~
:wq //保存退出
3、配置DNS服务区域数据文件（注意配置文件内容的书写格式）
[root@localhost ~]# cd /var/named //进入区域配置文件存放目录
[root@localhost named]# cp -p named.localhost kgc.com.lan //复制named.localhost为kgc.com.lan
[root@localhost named]# vim kgc.com.lan //进入编辑区域数据文件信息
$TTL 1D
@ IN SOA kgc.com. admin.kgc.com. ( //更改域名、管理邮箱
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS kgc.com. //更改域名服务器记录地址
A 192.168.100.1 //更改正向解析条目地址
www IN A 192.168.100.88 //添加www域名的解析地址
smtp IN A 192.168.100.99 //添加主机名解析地址
~
~
~
:wq //保存退出
[root@localhost named]# cp -p kgc.com.lan kgc.com.wan //复制kgc.com.lan为kgc.com.wan
[root@localhost named]# vim kgc.com.wan //进入编辑区域数据文件信息
$TTL 1D
@ IN SOA kgc.com. admin.kgc.com. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS kgc.com.
A 12.0.0.1 //更改解析地址为12.0.0.1即可
www IN A 12.0.0.1
smtp IN A 12.0.0.1
~
~
~
:wq //保存退出
启动并验证服务
1、启动DNS服务，并关闭防火墙与安全功能
[root@localhost named]# systemctl start named //启动DNS服务
[root@localhost named]# systemctl status named //查看服务启动情况
● named.service - Berkeley Internet Name Domain (DNS)
Loaded: loaded (/usr/lib/systemd/system/named.service; disabled; vendor preset: disabled)
Active: active (running) since 日 2019-09-08 15:32:06 CST; 17s ago //服务成功启动
Process: 23372 ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS (code=exited, status=0/SUCCESS)
Process: 23368 ExecStartPre=/bin/bash -c if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi (code=exited, status=0/SUCCESS)
Main PID: 23374 (named)
CGroup: /system.slice/named.service
└─23374 /usr/sbin/named -u named -c /etc/named.conf
...//省略部分内容...
[root@localhost named]# systemctl stop firewalld.service //关闭防火墙
[root@localhost named]# setenforce 0 //关闭增强性安全功能
