![Linux DNS(命名)服务](https://linux22.com/image/126674/Linux%20DNS%EF%BC%88%E5%91%BD%E5%90%8D%EF%BC%89%E6%9C%8D%E5%8A%A1.png)
如何将一些全球网站(google.com、Facebook.com)解析为本地 IP 地址(例如 192.168.0.1)。任何人都可以帮助我吗?
; Authoritative data for facebook.com zone
;
$TTL 1D
@ IN SOA epc.facebook.com root.epc.facebook.com. (
2017031301 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
$ORIGIN facebook.com.
epc IN A 127.0.0.1
facebook.com IN A 192.168.0.1
但挖掘结果:
; <<>> DiG 9.10.3-P4-Raspbian <<>> facebook.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21851
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;facebook.com. IN A
;; ANSWER SECTION:
facebook.com. 3441 IN A 185.60.216.35
;; Query time: 1 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Tue Jan 30 16:51:44 UTC 2018
;; MSG SIZE rcvd: 57
解析配置文件
# Generated by resolvconf
nameserver 192.168.0.1
命名:
cat named.conf.default-zones
// prime the server with knowledge of the root servers
zone "." {
type hint;
file "/etc/bind/db.root";
};
// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912
zone "localhost" {
type master;
file "/etc/bind/db.local";
};
zone "127.in-addr.arpa" {
type master;
file "/etc/bind/db.127";
};
zone "0.in-addr.arpa" {
type master;
file "/etc/bind/db.0";
};
zone "255.in-addr.arpa" {
type master;
file "/etc/bind/db.255";
};
zone "com.farizHost.arpa" {
type master ;
file "/etc/bind/fariz.zone.db" ;
};
和..
root@raspberrypi:/etc/bind# cat named.conf.options
options {
directory "/var/cache/bind";
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
// forwarders {
// 0.0.0.0;
// };
//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys. See https://www.isc.org/bind-keys
//========================================================================
dnssec-validation auto;
auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
};
答案1
为了解析域名 facebook.com,您需要添加一条指令:
zone "facebook.com" {
type master;
file "/etc/bind/facebook.db";
};
其中 facebook.db 是问题开头的文件。
您的 SOA 也应该得到纠正。
IN SOA epc.facebook.com. root.epc.facebook.com. (
顺便说一句,SOA 域不一定是 facebook.com。
答案2
这是绑定 RPZ 功能的工作,请参阅:https://dnsrpz.info/
域名服务响应策略区域 (DNS RPZ) 是一种允许名称服务器管理员将自定义信息覆盖在全局 DNS 之上的方法,以提供对查询的替代响应。它目前在 ISC BIND 名称服务器(9.8 或更高版本)中实现。 DNS RPZ 功能的另一个通用名称是“DNS 防火墙”。
正如您需要的文档中给出的:
response-policy { zone "badlist"; };
zone "badlist" {type master; file "master/badlist"; allow-query {none;}; };
在您的配置和“区域”文件中,master/badlist
如下所示:
$TTL 1H
@ SOA LOCALHOST. named-mgr.example.com (1 1h 15m 30d 2h)
NS LOCALHOST.
www.google.com A 192.168.0.1
www.facebook.com A 192.168.0.1