Local dns server linux

How to Setup a local DNS Caching Server on Linux?

Geekflare is supported by our audience. We may earn affiliate commissions from buying links on this site.

DNS lookups are not normally something that you need to worry about. Sometimes you should!

If your home or office’s ISP has slow nameservers or your server is performing lots of lookups, then you need a local caching DNS server.

How will a caching DNS server help me?

A caching DNS server works by performing all the DNS queries that your system makes and then saving, or caching, the results in memory. Once that the results are cached in memory any time that you make a duplicate request for a domain, the result will get served almost instantaneously from memory.

This may not seem too important, but if your ISP’s DNS servers are taking their time to respond, it will slow down your internet browsing considerably. For example, the home page for the US news channel MSNBC needs to contact over 100 unique domains names to load correctly. If your ISP’s name servers are taking even a 10th of a second longer than normal to respond, that means that the page will take 10 seconds longer to finish loading.

A local caching DNS server will not only help in your home or office it will also help on your server. If you have an application that makes lots of DNS lookups, for example, a busy email server running anti-spam software it will receive a speed boost from a local caching DNS server.

Finally, systemd-resolved supports the very latest, secure DNS standards DNSSEC and DNSoverTLS or DoT. These help keep you secure and retain your privacy online.

Which local caching DNS will we use?

The local caching DNS server that we will enable and configure in this guide is systemd-resolved. This tool is a part of the systemd suite of system management tools. If your system is using systemd, and almost all of the major Linux distributions are, then you will already have systemd-resolved installed but not running. Most distributions do not use systemd-resolved even though it is present.

systemd-resolved works by running a small local caching DNS server which we will configure to start on boot. We will then re-configure the rest of the system to direct their DNS queries to the local caching systemd-resolved DNS.

How to check if you are already using systemd-resolved?

Some Linux distributions are already using systemd-resolved by default such as Ubuntu 19.04.

If you are already running systemd-resolved then you do not need to enable it or configure your system to use it. You may, however, need to ensure that network management tools like NetworkManager are configured correctly as they can ignore system network configuration.

Before proceeding to the next section run the following command to check if you are already running systemd-resolved:

If you get the message:

You are not running systemd-resolved and should move on to the next section. If, instead, you see output that begins with something like the following:

Then you are already running systemd-resolved and do not need to enable it.

Enabling and configuring systemd-resolved

We do not need to install systemd-resolved as already a part of systemd. All that we need to do is to start it to get the DNS caching server running and then enable it to start it on boot.

Run the following command from a shell prompt as a sudo enabled a non-root user to start systemd-resolved:

Next, run the following command to start systemd-resolved on system boot-up:

The last item of configuration left is to set the DNS servers that systemd-resolved will query to resolved domains. There are many options here, but either of the following pairs is free, fast, and they both support DNSSEC and DoT:

Open the main systemd-resolved configuration file with your favorite text editor, here I have used nano:

Edit the line begins

So that a pair of the IP addresses are listed. Here, the Cloudflare DNS servers are shown:

Save and exit the text editor. We now need to restart systemd-resolved so that it starts to use the nameservers:

systemd-resolved is now running and ready to start speeding-up and securing DNS queries as soon as we configure the system to begin using it.

Configuring the system to use systemd-resolved

Your system can be configured in several ways to use systemd-resolved, but we will look at two configurations that cover most use cases. The first is the recommended configuration, and the second is the compatibility configuration. The difference between the two is how the /etc/resolv.conf file is managed.

The /etc/resolv.conf file holds the IP addresses of the nameservers that programs on the system should query. Programs that need to make DNS queries will consult this file to find out what servers they should contact to make those queries.

The two modes of systemd-resolved center around how the contents of this file are managed. In the recommended mode, /etc/resolv.conf is made a symlink to /run/systemd/resolve/stub-resolv.conf. This file is managed by systemd-resolved and therefore systemd-resolved manages the DNS configuration information for all other programs on the system.

This can cause problems when other programs try to manage the contents of /etc/resolv.conf. Compatibility mode leaves /etc/resolv.conf in place allowing other programs to manage it while systemd-resolved uses that DNS information. In this mode, the other programs managing /etc/resolv.conf must be configured to set 127.0.0.53 as the system nameserver in /etc/resolv.conf.

Configuring the recommended mode

When we configure this mode systemd-resolved will manage /etc/resolv.conf by making it a symlink to /run/systemd/resolve/stub-resolv.conf. We will need to do this by hand as it is not configured automatically.

First, delete or rename the existing /etc/resolv.conf file. Renaming is a better option to deleting it as it will have the same effect but you can always refer to the original if you need the information it contains. Here, we rename /etc/resolv.conf using the mv command:

Next, create the symlink:

Finally, restart systemd-resolved:

Configuring the compatibility mode

In this mode, you need to ensure that the local nameserver that systemd-resolved has started is queried by system services. Open /etc/resolv.conf in a text editor, here the nano editor is used:

Delete any lines you encounter that begin with “nameserver” and add this line:

This edit may get changed by any other program that is managing /etc/resolv.conf. If this is the case then you will need to configure those programs to use this nameserver to make the edit permanent.

Debugging systemd-resolved

Discovering exactly how your system is making DNS queries after you have made these changes can be difficult. The most effective way method of observing what is happening is to put systemd-resolved into debugging mode and watch the log file.

systemd-resolved is a systemd service, which means that it can be easily put into debugging mode by creating a drop-in service file that contains the debug setting. The following command will create the correct file in the correct location:

Paste the following lines into the editor then save and exit:

The systemd-resolved service will be automatically reloaded on a successful save and exit.

Open a second terminal to the same server and follow the journald log for the systemd-resolved service:

A line that begins “Using DNS server” e.g.:

Tells you exactly which DNS server is being used for DNS queries. In this case, the Cloudflare DNS server at 1.1.1.1 was queried.

Lines that being “Cache miss” indicate that the domain name has not been cached. E.g.:

Lines that begin “Positive cache hit” e.g.:

Indicate that systemd-resolved has queried this domain before and the answer was served from the cache in the local memory.

You should disable debugging mode when you have finished working systemd-resolved as it will create a very large log file on a busy system. You can disable the debug logging by running:

and deleting the two lines, you added then saving and exiting the editor.

Using secure DNS queries

systemd-resolved is one of the few, currently available DNS servers that support both DNSSEC and DNSoverTLS. Both of these help to ensure that you are receiving genuine DNS information (DNSSEC) and that no one can snoop on your DNS traffic as it passes over the internet. (DoT).

These options are easily enabled by opening systemd-resolved’s main configuration file with a text editor:

And editing the file so that the following two lines are set:

Save and exit the editor then reload systemd-resolved:

As long as the DNS server you have set support DNSSEC and DoT your DNS queries will be protected. The Google and Cloudflare public DNS servers both support these protocols.

Conclusion

Your system is now configured to speedily and efficiently make DNS queries even when your ISP’s DNS server are not responding as quickly as they should. Furthermore, your digital life is more secure as you are using the latest, secure DNS protocols to protect your DNS queries.

If you are Linux enthusiast and looking to learn more, then check out this fantastic online course.

Источник

Настройка DNS в Ubuntu

Сервера DNS используются системой для преобразования сложных для запоминания IP адресов в простые доменные имена. Это делается потому что людям сложно запоминать несколько никак не связанных цифр, но очень просто запомнить слово.

Когда компьютеру нужно узнать IP адрес какого-либо домена, он отправляет запрос известному ему DNS серверу. Эти сервера могут быть получены автоматически от роутера по DHCP или же заданы в ручную. В этой статье мы рассмотрим как выполняется настройка DNS Ubuntu 16.04 и более старых версиях.

Настройка DNS в Ubuntu через GUI

Раньше, для настройки DNS серверов, которые будут использоваться системой было достаточно внести адреса нужных серверов в файл /etc/resolv.conf. Но сейчас всей конфигурацией сети в Ubuntu управляет NetworkManager, а этот файл теперь представляет собой только ссылку на файл NetworkManager.

Этот способ до сих пор работает, но в нем вы можете настроить DNS на LiveCD, или до перезагрузки. После перезагрузки все настройки собьются и придется все делать заново. Поэтому, чтобы все сохранилось нужно выполнять все действия через интерфейс NetworkManager. Сначала откройте контекстное меню для значка сети на панели и выберите «Изменить подключения»:

Выберите ваше подключение и нажмите «Изменить»:

В открывшемся окне перейдите на вкладку «Параметры IPv4»:

Затем, в поле «Способ настройки» выберите «Автоматически (DHCP, только адрес)»:

Теперь немного ниже появиться поле «Серверы DNS», где вам нужно прописать нужные серверы, можно несколько адресов через запятую. Например, можно указать сервера от Google:

Поле этого нажмите «Сохранить» и «Закрыть». Теперь можете переподключитесь к этому соединению и можете проверять текущий DNS сервер:

Собственно, это все, но есть еще один способ настройки через консоль, если этот не сработал или вы предпочитаете работать из консоли.

Настройка DNS через терминал Ubuntu

В Ubuntu есть унифицированный интерфейс настройки сети, который настраивается через конфигурационный файл /etc/network/interfaces. Сначала смотрим список сетевых интерфейсов:

Откройте файл для редактирования и найдите в нем имя своего сетевого интерфейса, например, auto enp0s3, если такой секции нет, ее нужно добавить:

sudo vi /etc/network/interfaces

auto enp0s3
iface enp0s3 inet dhcp

Затем, добавьте в эту секцию строчку:

Здесь адрес 8.8.8.8 — это адрес вашего DNS сервера. Но эта настройка сработает, только если ваш DHCP клиент не пытается назначить адрес самостоятельно. Чтобы указать DNS адрес на уровне DHCP сервера нужно добавить такую строчку в конфигурационный файл /etc/dhcp/dhclient.conf:

sudo vi /etc/dhcp/dhclient.conf

supersede domain-name-servers 8.8.8.8

Здесь тоже адрес 8.8.8.8 означает адрес DNS сервера. Для верности, вы можете добавить свои адреса DNS серверов в файл /etc/resolvconf/resolv.conf.d/base:

sudo vi /etc/resolvconf/resolv.conf.d/base

Чтобы настройки вступили в силу необходимо перезапустить сеть:

sudo systemctl restart networking

Возможно, даже лучше будет если вы полностью перезагрузите компьютер. Теперь вы можете открыть /etc/resolv.conf и посмотреть применялся ли новый адрес DNS:

Как видите, в моем примере все заработало. Подобно этому выполняется настройка dns linux для любого дистрибутива.

Выводы

В этой небольшой статье мы рассмотрели как выполняется настройка DNS Ubuntu 16.04 через графический интерфейс или терминал. В Ubuntu автоматической настройкой DNS могут заниматься множество утилит и это создает некоторые проблемы при настройке, но со всем можно разобраться. Надеюсь, эта информация была полезной для вас.

Источник

Domain Name Service (DNS)

Domain Name Service (DNS) is an Internet service that maps IP addresses and fully qualified domain names (FQDN) to one another. In this way, DNS alleviates the need to remember IP addresses. Computers that run DNS are called name servers. Ubuntu ships with BIND (Berkley Internet Naming Daemon), the most common program used for maintaining a name server on Linux.

Installation

At a terminal prompt, enter the following command to install dns:

A very useful package for testing and troubleshooting DNS issues is the dnsutils package. Very often these tools will be installed already, but to check and/or install dnsutils enter the following:

Configuration

There are many ways to configure BIND9. Some of the most common configurations are a caching nameserver, primary server, and secondary server.

When configured as a caching nameserver BIND9 will find the answer to name queries and remember the answer when the domain is queried again.

As a primary server, BIND9 reads the data for a zone from a file on its host and is authoritative for that zone.

As a secondary server, BIND9 gets the zone data from another nameserver that is authoritative for the zone.

Overview

The DNS configuration files are stored in the /etc/bind directory. The primary configuration file is /etc/bind/named.conf , which in the layout provided by the package just includes these files.

• /etc/bind/named.conf.options : global DNS options
• /etc/bind/named.conf.local : for your zones
• /etc/bind/named.conf.default-zones : default zones such as localhost, its reverse, and the root hints

The root nameservers used to be described in the file /etc/bind/db.root . This is now provided instead by the /usr/share/dns/root.hints file shipped with the dns-root-data package, and is referenced in the named.conf.default-zones configuration file above.

It is possible to configure the same server to be a caching name server, primary, and secondary: it all depends on the zones it is serving. A server can be the Start of Authority (SOA) for one zone, while providing secondary service for another zone. All the while providing caching services for hosts on the local LAN.

Caching Nameserver

The default configuration acts as a caching server. Simply uncomment and edit /etc/bind/named.conf.options to set the IP addresses of your ISP’s DNS servers:

Replace 1.2.3.4 and 5.6.7.8 with the IP Addresses of actual nameservers.

To enable the new configuration, restart the DNS server. From a terminal prompt:

See dig for information on testing a caching DNS server.

Primary Server

In this section BIND9 will be configured as the Primary server for the domain example.com . Simply replace example.com with your FQDN (Fully Qualified Domain Name).

Forward Zone File

To add a DNS zone to BIND9, turning BIND9 into a Primary server, first edit /etc/bind/named.conf.local :

If bind will be receiving automatic updates to the file as with DDNS, then use /var/lib/bind/db.example.com rather than /etc/bind/db.example.com both here and in the copy command below.

Now use an existing zone file as a template to create the /etc/bind/db.example.com file:

Edit the new zone file /etc/bind/db.example.com and change localhost. to the FQDN of your server, leaving the additional . at the end. Change 127.0.0.1 to the nameserver’s IP Address and root.localhost to a valid email address, but with a . instead of the usual @ symbol, again leaving the . at the end. Change the comment to indicate the domain that this file is for.

Create an A record for the base domain, example.com . Also, create an A record for ns.example.com , the name server in this example:

You must increment the Serial Number every time you make changes to the zone file. If you make multiple changes before restarting BIND9, simply increment the Serial once.

Now, you can add DNS records to the bottom of the zone file. See Common Record Types for details.

Many admins like to use the last date edited as the serial of a zone, such as 2020012100 which is yyyymmddss (where ss is the Serial Number)

Once you have made changes to the zone file BIND9 needs to be restarted for the changes to take effect:

Reverse Zone File

Now that the zone is setup and resolving names to IP Addresses, a Reverse zone needs to be added to allows DNS to resolve an address to a name.

Edit /etc/bind/named.conf.local and add the following:

Replace 1.168.192 with the first three octets of whatever network you are using. Also, name the zone file /etc/bind/db.192 appropriately. It should match the first octet of your network.

Now create the /etc/bind/db.192 file:

Next edit /etc/bind/db.192 changing the same options as /etc/bind/db.example.com :

The Serial Number in the Reverse zone needs to be incremented on each change as well. For each A record you configure in /etc/bind/db.example.com , that is for a different address, you need to create a PTR record in /etc/bind/db.192 .

After creating the reverse zone file restart BIND9:

Secondary Server

Once a Primary Server has been configured a Secondary Server is highly recommended in order to maintain the availability of the domain should the Primary become unavailable.

First, on the Primary server, the zone transfer needs to be allowed. Add the allow-transfer option to the example Forward and Reverse zone definitions in /etc/bind/named.conf.local :

Replace 192.168.1.11 with the IP Address of your Secondary nameserver.

Restart BIND9 on the Primary server:

Next, on the Secondary server, install the bind9 package the same way as on the Primary. Then edit the /etc/bind/named.conf.local and add the following declarations for the Forward and Reverse zones:

Replace 192.168.1.10 with the IP Address of your Primary nameserver.

Restart BIND9 on the Secondary server:

In /var/log/syslog you should see something similar to the following (some lines have been split to fit the format of this document):

Note: A zone is only transferred if the Serial Number on the Primary is larger than the one on the Secondary. If you want to have your Primary DNS notifying other Secondary DNS Servers of zone changes, you can add also-notify < ipaddress; >; to /etc/bind/named.conf.local as shown in the example below:

The default directory for non-authoritative zone files is /var/cache/bind/ . This directory is also configured in AppArmor to allow the named daemon to write to it. For more information on AppArmor see Security — AppArmor.

Troubleshooting

This section covers diagnosing problems with DNS and BIND9 configurations.

Testing

resolv.conf

The first step in testing BIND9 is to add the nameserver’s IP Address to a hosts resolver. The Primary nameserver should be configured as well as another host to double check things. Refer to DNS client configuration for details on adding nameserver addresses to your network clients. In the end your nameserver line in /etc/resolv.conf should be pointing at 127.0.0.53 and you should have a search parameter for your domain. Something like this:

To check which DNS server your local resolver is using, run:

You should also add the IP Address of the Secondary nameserver to your client configuration in case the Primary becomes unavailable.

If you installed the dnsutils package you can test your setup using the DNS lookup utility dig:

After installing BIND9 use dig against the loopback interface to make sure it is listening on port 53. From a terminal prompt:

You should see lines similar to the following in the command output:

If you have configured BIND9 as a Caching nameserver “dig” an outside domain to check the query time:

Note the query time toward the end of the command output:

After a second dig there should be improvement:

Now to demonstrate how applications make use of DNS to resolve a host name use the ping utility to send an ICMP echo request:

This tests if the nameserver can resolve the name ns.example.com to an IP Address. The command output should resemble:

named-checkzone

A great way to test your zone files is by using the named-checkzone utility installed with the bind9 package. This utility allows you to make sure the configuration is correct before restarting BIND9 and making the changes live.

To test our example Forward zone file enter the following from a command prompt:

If everything is configured correctly you should see output similar to:

Similarly, to test the Reverse zone file enter the following:

The output should be similar to:

The Serial Number of your zone file will probably be different.

Quick temporary query logging

With the rndc tool, you can quickly turn query logging on and off, without restarting the service or changing the configuration file.

To turn query logging on, run:

Likewise, to turn it off, run:

The logs will be sent to syslog and will show up in /var/log/syslog by default:

The amount of logs generated by enabling querylog could be huge!

Logging

BIND9 has a wide variety of logging configuration options available, but the two main ones are channel and category, which configure where logs go, and what information gets logged, respectively.

If no logging options are configured the default configuration is:

Let’s instead configure BIND9 to send debug messages related to DNS queries to a separate file.

We need to configure a channel to specify which file to send the messages to, and a category. In this example, the category will log all queries. Edit /etc/bind/named.conf.local and add the following:

The debug option can be set from 1 to 3. If a level isn’t specified, level 1 is the default.

Since the named daemon runs as the bind user the /var/log/named directory must be created and the ownership changed:

Now restart BIND9 for the changes to take effect:

You should see the file /var/log/named/query.log fill with query information. This is a simple example of the BIND9 logging options. For coverage of advanced options see More Information.

References

Common Record Types

This section covers some of the most common DNS record types.

A record: This record maps an IP Address to a hostname.

CNAME record: Used to create an alias to an existing A record. You cannot create a CNAME record pointing to another CNAME record.

MX record: Used to define where email should be sent to. Must point to an A record, not a CNAME .

NS record: Used to define which servers serve copies of a zone. It must point to an A record, not a CNAME . This is where Primary and Secondary servers are defined.

More Information

DNS and BIND is a popular book now in it’s fifth edition. There is now also a DNS and BIND on IPv6 book.

A great place to ask for BIND9 assistance, and get involved with the Ubuntu Server community, is the #ubuntu-server IRC channel on freenode.

Источник