PowerDNS实现递归+权威解析

Posted on Views:

PowerDNS 4.1以后已经移除了 Authoritative Server 的递归功能，推荐将权威DNS和递归DNS分离。

  • 权威DNS：PowerDNS Authoritative Server（pdns_server）
  • 递归DNS：PowerDNS Recursor（pdns_recursor）

1.架构

              客户端
                |
                | DNS Query
                v
        +----------------+
        | PowerDNS       |
        | Recursor       |
        | 53/UDP TCP     |
        +----------------+
                |
       ---------------------
       |                   |
       v                   v
  本地缓存              外部DNS层级查询
                        |
                        |
             root -> .com -> example.com
                        |
                        v
                 权威DNS服务器


        +----------------+
        | PowerDNS Auth  |
        | pdns_server    |
        | 5300端口       |
        +----------------+
          内部域名解析

2.compose

2.1init.sql

2.2docker-compose.yml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
services:
  # ----------------------------
  # MySQL 数据库
  # ----------------------------
  pdns-mysql:
    image: mysql:8.0
    container_name: pdns_mysql
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
      MYSQL_DATABASE: ${MYSQL_DATABASE}
      MYSQL_USER: ${MYSQL_USER}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
    command: --default-authentication-plugin=mysql_native_password
    volumes:
      - ./db_data:/var/lib/mysql
      - ./init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    networks:
      pdns_net:
        ipv4_address: 192.168.9.11

  # ----------------------------
  # PowerDNS authoritative server
  # ----------------------------
  pdns-auth:
    image: powerdns/pdns-auth-49:latest
    # powerdns/pdns-auth-48:latest
    container_name: pdns_auth
    depends_on:
      - pdns-mysql
    restart: always
    ports:
      - "8081:8081"   # PDNS API/Web 端口
      - "5300:53/tcp"
      - "5300:53/udp"
    volumes:
          - ./conf/pdns.conf:/etc/powerdns/pdns.conf:ro   
    command:
      - --launch=gmysql
      - --gmysql-host=${MYSQL_HOST}
      - --gmysql-user=${MYSQL_USER}
      - --gmysql-password=${MYSQL_PASSWORD}
      - --gmysql-dbname=${MYSQL_DATABASE}
      - --api=yes
      - --api-key=${API_KEY}
      - --webserver=yes
      - --webserver-address=0.0.0.0
      - --webserver-port=8081
      - --webserver-allow-from=0.0.0.0/0
    networks:
      pdns_net:
        ipv4_address: 192.168.9.12
  
  pdns-recursor:
    image: powerdns/pdns-recursor-49:latest
    container_name: pdns_recursor
    restart: always
    depends_on:
      - pdns-auth
    volumes:
      - ./conf/recursor.conf:/etc/powerdns/recursor.conf:ro
    ports:
      - "53:53/udp"
      - "53:53/tcp"
    networks:
      pdns_net:
        ipv4_address: 192.168.9.13
  # ----------------------------
  # PowerDNS-Admin 管理面板
  # ----------------------------
  pdns-admin:
    image: powerdnsadmin/pda-legacy:latest
    container_name: pdns_admin
    depends_on:
      - pdns-mysql
      - pdns-auth
      - pdns-recursor
    restart: always
    ports:
      - "9191:80"
    environment:
      SQLALCHEMY_DATABASE_URI: mysql://${MYSQL_USER}:${MYSQL_PASSWORD}@${MYSQL_HOST}/${MYSQL_DATABASE}
      GUNICORN_TIMEOUT: 60
      GUNICORN_WORKERS: 2
      GUNICORN_LOGLEVEL: DEBUG
      # PDA 连接 PDNS API
      PDNS_STATS_URL: http://pdns-auth:8081
      PDNS_API_KEY: ${API_KEY}
    networks:
      pdns_net:
        ipv4_address: 192.168.9.14

networks:
  pdns_net:
    driver: bridge
    ipam:
      config:
        - subnet: 192.168.9.0/24

.env

MYSQL_ROOT_PASSWORD=321.321
MYSQL_DATABASE=powerdns
MYSQL_USER=pdns
MYSQL_PASSWORD=changeme
MYSQL_HOST=pdns-mysql
API_KEY=9aaecc263862c77f7cf726202a1190ab

2.3pdns.conf

# pdns.conf
local-address=0.0.0.0
local-port=53
include-dir=/etc/powerdns/pdns.d

2.4recursor.conf

# recursor.conf
local-address=0.0.0.0
local-port=53

# 1.允许哪些客户端递归
allow-from=127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12

# 2.允许向私有 IP 转发（关键）
dont-query=

# 3.关闭内部域名的 DNSSEC 校验（关键）
dnssec=off

# 4.内部域交给pdns-auth(多个逗号分割)
forward-zones=g.lo=192.168.9.12:53

# 5.上游DNS
forward-zones-recurse=.=8.8.8.8;1.1.1.1

2.5start

docker-compose pull && docker-compose up -d

3. dns测试

3.1递归查询：

1
dig @127.0.0.1 www.baidu.com

正常：

;; flags: qr rd ra

其中：

标志 含义
rd 客户端请求递归
ra 服务器支持递归 
客户端查询：

db.corp.local
        |
        v
pdns-recursor
        |
        +---- g.lo
        |
        v
pdns_server:5300

返回内部记录

3.3权威查询

dig @127.0.0.1 m1.g.lo

dig @127.0.0.1 -p 5300 m1.g.lo

其他公网域：

www.google.com

走正常递归：

pdns-recursor
       |
       root DNS
       |
       .com
       |
       google.com