基于腾讯云自建高可用DNS方案实践

[root@VM-2-15-centos ~] hostnamectl set-hostname node4.rocky.com
[root@VM-2-16-centos ~] hostnamectl set-hostname node5.rocky.com

[root@node4 ~]# cat /etc/hosts
127.0.0.1 VM-6-15-centos VM-6-15-centos
127.0.0.1 localhost.localdomain localhost
127.0.0.1 localhost4.localdomain4 localhost4
10.0.6.15 node4 node4.rocky.com
10.0.6.16 node5 node5.rocky.com

[root@node4 ~]# yum -y install bind
[root@node5 ~]# yum -y install bind

[root@node4 ~]# cat /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html
acl "trusted-recursion" { # 设置acl
 localhost;
 10.0.0.0/16;
};
options {
 listen-on port 53 { any; }; #设置监听端口，也可写具体的网段
 listen-on-v6 port 53 { any; };
 directory "/var/named";
 dump-file "/var/named/data/cache_dump.db";
 statistics-file "/var/named/data/named_stats.txt";
 memstatistics-file "/var/named/data/named_mem_stats.txt";
 recursing-file "/var/named/data/named.recursing";
 secroots-file "/var/named/data/named.secroots";
 allow-query { any; }; #开放查询 
 allow-recursion { trusted-recursion; }; #指定允许哪些主机可以从缓存中获取答案。
 allow-query-cache { trusted-recursion; }; # 指定允许那些主机可以通过本服务器进行递归查询。
 /*
 - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
 - If you are building a RECURSIVE (caching) DNS server, you need to enable
 recursion.
 - If your recursive DNS server has a public IP address, you MUST enable access
 control to limit queries to your legitimate users. Failing to do so will
 cause your server to become part of large scale DNS amplification
 attacks. Implementing BCP38 within your network would greatly
 reduce such attack surface
 */
 recursion yes;
 dnssec-enable no;
 dnssec-validation no; # 关闭dnssec安全验证
 /* Path to ISC DLV key */
 #bindkeys-file "/etc/named.root.key";
 managed-keys-directory "/var/named/dynamic";
 pid-file "/run/named/named.pid";
 session-keyfile "/run/named/session.key";
 forwarders {
 183.60.83.19; # 腾讯云VPCGW DNS地址
 183.60.82.98; # 腾讯云VPCGW DNS地址
 };
};
logging {
 channel default_debug {
 file "data/named.run";
 severity dynamic;
 };
};
zone "." IN {
 type hint;
 file "named.ca";
};
#include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
zone "rocky.com" { # 域名
 type master; #主DNS
 file "dynamic/rocky.com.zone"; # zone file path #正向区域文件
 notify yes;
};
zone "6.0.10.in-addr.arpa" in {
 type master;
 file "dynamic/6.0.10.in-addr.arpa.zone"; #反向区域文件
 notify yes;
};

#客户端访问企业内部域名
[root@node4 ~]# nslookup www.rocky.com
Server: 10.0.6.15
Address: 10.0.6.15#53
Name: www.rocky.com
Address: 10.0.6.100

[root@node4 ~]# nslookup 10.0.6.100
100.6.0.10.in-addr.arpa name = www.rocky.com.

#客户端访问外网域名
[root@node4 ~]# nslookup www.baidu.com
Server: 10.0.6.15
Address: 10.0.6.15#53
Non-authoritative answer:
www.baidu.com canonical name = www.a.shifen.com.
Name: www.a.shifen.com
Address: 110.242.68.3
Name: www.a.shifen.com
Address: 110.242.68.4
#客户端访问腾讯云内网服务域名
[root@node4 ~]# nslookup mirrors.tencent.com
Server: 10.0.6.15
Address: 10.0.6.15#53
Non-authoritative answer:
mirrors.tencent.com canonical name = mirrors.cloud.tencent.com.
mirrors.cloud.tencent.com canonical name = mirrors.cloud.tencent.com.cdn.dnsv1.com.
mirrors.cloud.tencent.com.cdn.dnsv1.com canonical name = 14io0gsu.sched.dma.tdnsv5.com.
Name: 14io0gsu.sched.dma.tdnsv5.com
Address: 113.240.69.235
Name: 14io0gsu.sched.dma.tdnsv5.com
Address: 113.240.69.180
[root@node4 ~]#

[root@node6 ~]# cat /etc/resolv.conf
; generated by /usr/sbin/dhclient-script
#nameserver 183.60.83.19
#nameserver 183.60.82.98
nameserver 10.0.2.2 #内网LB地址
#解析业务域名

[root@node6 ~]# nslookup www.rocky.com
Server: 10.0.2.2
Address: 10.0.2.2#53
Name: www.rocky.com
Address: 10.0.6.100
#解析腾讯内网域名
[root@node6 ~]# nslookup mirrors.tencent.com
Server: 10.0.2.2
Address: 10.0.2.2#53
Non-authoritative answer:
mirrors.tencent.com canonical name = mirrors.cloud.tencent.com.
mirrors.cloud.tencent.com canonical name = mirrors.cloud.tencent.com.cdn.dnsv1.com.
mirrors.cloud.tencent.com.cdn.dnsv1.com canonical name = 14io0gsu.sched.dma.tdnsv5.com.
Name: 14io0gsu.sched.dma.tdnsv5.com
Address: 113.240.69.180
Name: 14io0gsu.sched.dma.tdnsv5.com
Address: 113.240.69.235
[root@node6 ~]# nslookup myqcloud.com
Server: 10.0.2.2
Address: 10.0.2.2#53
Non-authoritative answer:
Name: myqcloud.com
Address: 0.0.0.1
#解析外网域名
[root@node6 ~]# nslookup www.jd.com
Server: 10.0.2.2
Address: 10.0.2.2#53
Non-authoritative answer:
www.jd.com canonical name = www.jd.com.gslb.qianxun.com.
www.jd.com.gslb.qianxun.com canonical name = jd-abroad.cdn20.com.
Name: jd-abroad.cdn20.com
Address: 121.57.82.89
Name: jd-abroad.cdn20.com
Address: 36.111.141.54
Name: jd-abroad.cdn20.com
Address: 121.57.82.88
Name: jd-abroad.cdn20.com
Address: 121.57.82.17
Name: jd-abroad.cdn20.com
Address: 42.81.145.189
Name: jd-abroad.cdn20.com
Address: 113.24.194.72
Name: jd-abroad.cdn20.com
Address: 240e:918:1a00:201::33
Name: jd-abroad.cdn20.com
Address: 240e:928:101::1e
Name: jd-abroad.cdn20.com
Address: 240e:918:1a00:201::15
Name: jd-abroad.cdn20.com
Address: 240e:925:2:101::6

coredns.io:5300 {
file /etc/coredns/zones/coredns.io.db
}
example.io:53 {
errors
log
file /etc/coredns/zones/example.io.db
}
example.net:53 {
file /etc/coredns/zones/example.net.db
}
.:53 {
errors
log
health
rewrite name foo.example.com foo.default.svc.cluster.local
}

[root@node1~]# yum -y install etcd
[root@node11 ~]# systemctl enable etcd; systemctl start etcd
Created symlink from /etc/systemd/system/multi-user.target.wants/etcd.service to /usr/lib/systemd/system/etcd.service.

[root@node1 etcd]# egrep ^[A-Z] etcd.conf
ETCD_DATA_DIR="/var/lib/etcd/node1.etcd"
ETCD_LISTEN_PEER_URLS="http://10.0.2.4:2380"
ETCD_LISTEN_CLIENT_URLS="http://10.0.2.4:2379,http://127.0.0.1:2379"
ETCD_NAME="node1"
ETCD_INITIAL_ADVERTISE_PEER_URLS="http://10.0.2.4:2380"
ETCD_ADVERTISE_CLIENT_URLS="node1=http://10.0.2.4:2379"
ETCD_INITIAL_CLUSTER="node1=http://10.0.2.4:2379,node2=http://10.0.2.8:2379,node3=http://10.0.2.15:2379"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"

[root@node2 ~]# egrep ^[A-Z] /etc/etcd/etcd.conf
ETCD_DATA_DIR="/var/lib/etcd/node2.etcd"
ETCD_LISTEN_PEER_URLS="http://10.0.2.8:2380"
ETCD_LISTEN_CLIENT_URLS="http://10.0.2.8:2379,http://127.0.0.1:2379"
ETCD_NAME="node2"
ETCD_INITIAL_ADVERTISE_PEER_URLS="http://10.0.2.8:2380"
ETCD_ADVERTISE_CLIENT_URLS="http://10.0.2.8:2379"
ETCD_INITIAL_CLUSTER="node1=http://10.0.2.4:2380,node2=http://10.0.2.8:2380,node3=http://10.0.2.15:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"
[root@node2 ~]#

[root@node3 ~]# egrep ^[A-Z] /etc/etcd/etcd.conf
ETCD_DATA_DIR="/var/lib/etcd/node3.etcd"
ETCD_LISTEN_PEER_URLS="http://10.0.2.15:2380"
ETCD_LISTEN_CLIENT_URLS="http://10.0.2.15:2379,http://127.0.0.1:2379"
ETCD_NAME="node3"
ETCD_INITIAL_ADVERTISE_PEER_URLS="http://10.0.2.15:2380"
ETCD_ADVERTISE_CLIENT_URLS="http://10.0.2.15:2379"
ETCD_INITIAL_CLUSTER="node1=http://10.0.2.4:2380,node2=http://10.0.2.8:2380,node3=http://10.0.2.15:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"

[root@node1 ~]# systemctl start etcd.service
[root@node1 ~]# systemctl status etcd.service
etcd.service - Etcd Server
   Loaded: loaded (/usr/lib/systemd/system/etcd.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2022-02-15 13:50:16 CST; 10h ago
 Main PID: 10451 (etcd)
   CGroup: /system.slice/etcd.service
           └─10451 /usr/bin/etcd --name=node1 --data-dir=/var/lib/etcd/node1.etcd --listen-client-urls=http://10.0.2.4:2379,http://127.0.0.1:2379

[root@node1 ~]# etcdctl member list
5432b0f7395992d2: name=node1 peerURLs=http://10.0.2.4:2380 clientURLs=http://10.0.2.4:2379 isLeader=true
589358f881fe72a1: name=node2 peerURLs=http://10.0.2.8:2380 clientURLs=http://10.0.2.8:2379 isLeader=false
bb72602d9eb35069: name=node3 peerURLs=http://10.0.2.15:2380 clientURLs=http://10.0.2.15:2379 isLeader=false

[root@node1 ~]# etcdctl cluster-health
member 5432b0f7395992d2 is healthy: got healthy result from http://10.0.2.4:2379
member 589358f881fe72a1 is healthy: got healthy result from http://10.0.2.8:2379
member bb72602d9eb35069 is healthy: got healthy result from http://10.0.2.15:2379
cluster is healthy

[root@dns1 ~]# tar zxvf coredns_1.6.4_linux_amd64.tgz
[root@dns1 ~]# mv coredns /usr/bin/
[root@dns1 ~]# mkdir /etc/coredns

[root@node1 ~]# cat /etc/coredns/Corefile
. {  # 监听tcp和udp的53端口
    etcd node1.rocky.com node2.rocky.com node3.rocky.com 10.in-addr.arpa { # 配置启用etcd插件,后面可以指定域名
        stubzones # 启用存根区域功能
        path /skydns # etcd里面的路径 默认为/skydns，以后所有的dns记录就是存储在该存根路径底下
        endpoint http://10.0.2.4:2379  http://10.0.2.8:2379 http://10.0.2.15:2379 # etcd访问地址，多个空格分开
        upstream  183.60.83.19:53  183.60.82.98:53 # 设置要使用的上游解析程序解决指向外部域名的在etcd（认为CNAME）中找到的外部域名。
    }
    cache 600  # 缓存600秒
    loadbalance # 负载均衡，开启DNS记录轮询策略
    forward . 183.60.82.98:53  183.60.83.19:53 # 上面etcd未查询到的请求转发给设置的DNS服务器解析
}

myqcloud.com {
    cache 600 myqcloud.com 
    loadbalance
    forward . 119.29.29.29:53
}

tencent-cloud.com {
 hosts { 
  10.210.104.113 cls-i0fxloot.ccs.tencent-cloud.com
  10.210.49.4 cls-88b89rhb.ccs.tencent-cloud.com
  10.210.104.35 cls-o4rn1235.ccs.tencent-cloud.com
  fallthrough
    }
}

[root@node1 ~]# cat /usr/lib/systemd/system/coredns.service
[Unit]
Description=CoreDNS DNS server
Documentation=https://coredns.io
After=network.target

[Service]
PermissionsStartOnly=true
LimitNOFILE=1048576
LimitNPROC=512
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
NoNewPrivileges=true
User=coredns
WorkingDirectory=~
ExecStart=/usr/bin/coredns -conf=/etc/coredns/Corefile
ExecReload=/bin/kill -SIGUSR1 $MAINPID
Restart=on-failure

[Install]
WantedBy=multi-user.target
[root@node1 ~]#

[root@node1 ~]# systemctl status coredns
● coredns.service - CoreDNS DNS server
   Loaded: loaded (/usr/lib/systemd/system/coredns.service; disabled; vendor preset: disabled)
   Active: active (running) since Tue 2022-02-15 16:13:43 CST; 4s ago
     Docs: https://coredns.io
 Main PID: 30288 (coredns)
   CGroup: /system.slice/coredns.service
           └─30288 /usr/bin/coredns -conf=/etc/coredns/Corefile

Feb 15 16:13:43 node1.rocky.com systemd[1]: Started CoreDNS DNS server.
Feb 15 16:13:43 node1.rocky.com coredns[30288]: .:53
Feb 15 16:13:43 node1.rocky.com coredns[30288]: myqcloud.com.:53
Feb 15 16:13:43 node1.rocky.com coredns[30288]: tencent-cloud.com.:53
Feb 15 16:13:43 node1.rocky.com coredns[30288]: ______                ____  _   _______
Feb 15 16:13:43 node1.rocky.com coredns[30288]: / ____/___  ________  / __ \/ | / / ___/        ~ CoreDNS-1.6.4
Feb 15 16:13:43 node1.rocky.com coredns[30288]: / /   / __ \/ ___/ _ \/ / / /  |/ /\__ \         ~ linux/amd64, ...dirty
Feb 15 16:13:43 node1.rocky.com coredns[30288]: / /___/ /_/ / /  /  __/ /_/ / /|  /___/ /
Feb 15 16:13:43 node1.rocky.com coredns[30288]: \____/\____/_/   \___/_____/_/ |_//____/
Hint: Some lines were ellipsized, use -l to show in full.
[root@node1 ~]# ^C
[root@node1 ~]# systemctl enable coredns
Created symlink from /etc/systemd/system/multi-user.target.wants/coredns.service to /usr/lib/systemd/system/coredns.service.

root@node1 ~]# etcdctl put /skydns/com/rocky/node1 '{"host":"10.0.2.4","ttl":10}'
No help topic for 'put'
[root@node1 ~]# export ETCDCTL_API=3
[root@node1 ~]# etcdctl put /skydns/com/rocky/node1 '{"host":"10.0.2.4","ttl":10}'
OK
[root@node1 ~]# vim .bashrc
[root@node1 ~]#
[root@node1 ~]#
[root@node1 ~]# etcdctl put /skydns/com/rocky/node2 '{"host":"10.0.2.8","ttl":10}'
OK
[root@node1 ~]# etcdctl put /skydns/com/rocky/node3 '{"host":"10.0.2.15","ttl":10}'
OK
[root@node1 ~]# etcdctl put /skydns/com/rocky/node1 '{"host":"www.tam3.com","ttl":10}'
OK
[root@node1 ~]#

[root@node1 ~]# dig @node1 www.tam3.com

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.7 <<>> @node1 www.tam3.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1734
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.tam3.com.                  IN      A

;; ANSWER SECTION:
www.tam3.com.           160     IN      CNAME   tam3.com.
tam3.com.               160     IN      A       3.33.152.147
tam3.com.               160     IN      A       15.197.142.173

;; Query time: 622 msec
;; SERVER: 10.0.2.4#53(10.0.2.4)
;; WHEN: Tue Feb 15 16:25:24 CST 2022
;; MSG SIZE  rcvd: 123