服务器使用 pdnsd 部署 DNS forwarder 的方法

cokebar 2014-11-16 18:15 2023-03-14 21:51 网络技术 88 条评论

Assume that you use Ubuntu.

Download & Install pdnsd:

apt-get install pdnsd

1	apt-get install pdnsd

At the setup configuration step, choose manual. Then modify the config file: /etc/pdnsd.conf

At the global section, change server_ip, add server_port, increase or decrease the perm_cache, change min_ttl & max_ttl at your own need, just like:

global {
	perm_cache=4096;   //cache size,KB
	cache_dir="/var/cache/pdnsd";  //cache file position
	run_as="pdnsd";     //just leave default
	server_ip = 0.0.0.0;  // Use your interface name, or your IP address
				// or 0.0.0.0
	server_port = 1212;   //bind port, just do not use port 53
	status_ctl = on;
  	paranoid=on;
//	query_method=tcp_udp;	// pdnsd must be compiled with tcp
				// query support for this to work.
	min_ttl=1d;       // Retain cached entries at least 1 day.
	max_ttl=1w;	   // One week.
	neg_ttl=120s;
	timeout=5;        // Global timeout option (10 seconds).
}

global {

perm_cache=4096; //cache size,KB

cache_dir="/var/cache/pdnsd"; //cache file position

run_as="pdnsd"; //just leave default

server_ip = 0.0.0.0; // Use your interface name, or your IP address

// or 0.0.0.0

server_port = 1212; //bind port, just do not use port 53

status_ctl = on;

paranoid=on;

// query_method=tcp_udp; // pdnsd must be compiled with tcp

// query support for this to work.

min_ttl=1d; // Retain cached entries at least 1 day.

max_ttl=1w; // One week.

neg_ttl=120s;

timeout=5; // Global timeout option (10 seconds).

}

Then add the upstream DNS server, just like:

server {
	label = "mydns";
	ip = 	1.2.3.4
	,	1.2.3.5
	,	1.2.3.6
	;
	timeout = 3;
	uptest = none;
	purge_cache = off;
	edns_query = on;
	exclude = .localdomain;
}

server {

label = "mydns";

ip = 1.2.3.4

, 1.2.3.5

, 1.2.3.6

;

timeout = 3;

uptest = none;

purge_cache = off;

edns_query = on;

exclude = .localdomain;

}

Comment out the unnecessary sections, such as root-servers & resolvconf:

/*
server {
    label="resolvconf";
}
*/

/*
server {
	label = "root-servers";
	root_server=on;
...
...
	policy = included;
	preset = off;
}
*/

server {

label="resolvconf";

}

server {

label = "root-servers";

root_server=on;

...

policy = included;

preset = off;

}

Here’s an example for pdnsd.conf

To see more details of pdnsd, just look at pdnsd Documents

Modify the file /etc/default/pdnsd, change START_DAEMON=no to START_DAEMON=yes and save the file. Finally start pdnsd:

service pdnsd start

1	service pdnsd start

Add firewall rule if neccessary (Assume that you use UFW):

ufw allow 1212

1	ufw allow 1212

Check it on your PC:

dig @X.X.X.X -p 1212 www.youtube.com

; <<>> DiG 9.9.5-3-Ubuntu <<>> @X.X.X.X -p 2121 www.youtube.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64845
;; flags: qr rd ra; QUERY: 1, ANSWER: 12, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1024
;; QUESTION SECTION:
;www.youtube.com.               IN      A

;; ANSWER SECTION:
www.youtube.com.        86400   IN      CNAME   youtube-ui.l.google.com.
youtube-ui.l.google.com. 86400  IN      A       173.194.117.232
youtube-ui.l.google.com. 86400  IN      A       173.194.117.231
youtube-ui.l.google.com. 86400  IN      A       173.194.117.233
youtube-ui.l.google.com. 86400  IN      A       173.194.117.238
youtube-ui.l.google.com. 86400  IN      A       173.194.117.224
youtube-ui.l.google.com. 86400  IN      A       173.194.117.227
youtube-ui.l.google.com. 86400  IN      A       173.194.117.225
youtube-ui.l.google.com. 86400  IN      A       173.194.117.230
youtube-ui.l.google.com. 86400  IN      A       173.194.117.229
youtube-ui.l.google.com. 86400  IN      A       173.194.117.228
youtube-ui.l.google.com. 86400  IN      A       173.194.117.226

;; Query time: 80 msec
;; SERVER: X.X.X.X#1212(X.X.X.X)
;; WHEN: Sun Nov 16 10:13:39 UTC 2014
;; MSG SIZE  rcvd: 254

dig @X.X.X.X -p 1212 www.youtube.com

; <<>> DiG 9.9.5-3-Ubuntu <<>> @X.X.X.X -p 2121 www.youtube.com

; (1 server found)

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64845

;; flags: qr rd ra; QUERY: 1, ANSWER: 12, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags:; udp: 1024

;; QUESTION SECTION:

;www.youtube.com. IN A

;; ANSWER SECTION:

www.youtube.com. 86400 IN CNAME youtube-ui.l.google.com.

youtube-ui.l.google.com. 86400 IN A 173.194.117.232

youtube-ui.l.google.com. 86400 IN A 173.194.117.231

youtube-ui.l.google.com. 86400 IN A 173.194.117.233

youtube-ui.l.google.com. 86400 IN A 173.194.117.238

youtube-ui.l.google.com. 86400 IN A 173.194.117.224

youtube-ui.l.google.com. 86400 IN A 173.194.117.227

youtube-ui.l.google.com. 86400 IN A 173.194.117.225

youtube-ui.l.google.com. 86400 IN A 173.194.117.230

youtube-ui.l.google.com. 86400 IN A 173.194.117.229

youtube-ui.l.google.com. 86400 IN A 173.194.117.228

youtube-ui.l.google.com. 86400 IN A 173.194.117.226

;; Query time: 80 msec

;; SERVER: X.X.X.X#1212(X.X.X.X)

;; WHEN: Sun Nov 16 10:13:39 UTC 2014

;; MSG SIZE rcvd: 254

pve物理机启用IPv6

DNS，pdnsd

88 条评论

引用: Shadowsocks+ChinaDNS实现OpenWRT路由器自动翻墙
wangsmile 2014-11-25 于 09:00 回复

我在VPS安装这个，然后您的文章：Shadowsocks+ChinaDNS实现OpenWRT路由器自动翻墙

就可以实现方案一了吧？
wangsmile 2014-11-25 于 11:12 回复

server {
label = “mydns”;
root_server=on;
ip = 1.2.3.4

这里的IP是设置成什么？
1. cokebar 文章作者 2014-11-25 于 11:42 回复
  
  最好填VPS自身用的的DNS，/etc/resovl.conf里有
wangsmile 2014-11-25 于 11:30 回复

service pdnsd start

返回：
Not starting pdnsd (disabled in /etc/default/pdnsd)

是个空文件。。。。。
wangsmile 2014-11-25 于 11:31 回复

文件又出来了。。。不好意思
wangsmile 2014-11-25 于 12:04 回复

server_ip = 我填的是0.0.0.0

这里 //query_method=tcp_udp; 为什么注释掉？我看有的写 tcp_only 有的写udp_only，默认的是哪个呢？

按你说的查了一下： ip=8.8.8.8, 8.8.4.4 , 4.2.2.1 , 4.2.2.2;
1. cokebar 文章作者 2014-11-25 于 12:28 回复
  
  默认应该是UDP only
wangsmile 2014-11-25 于 12:11 回复

Add firewall rule if neccessary:

1
ufw allow 1212

我运行UFW发现我的VPS没有安装UFW，是不是不用安装再运行这条命令了？
1. cokebar 文章作者 2014-11-25 于 12:38 回复
  
  默认防火墙不开你没开就不用配置了
wangsmile 2014-11-25 于 12:34 回复

我运行成功了，那么您的文章：Shadowsocks+ChinaDNS实现OpenWRT路由器自动翻墙

方案一的端口我填的是PDNSD里设置的server_port = 1212。
方案一的IP填什么？我的VPS的IP吗？
1. cokebar 文章作者 2014-11-25 于 12:40 回复
  
  把chinadns的国外dns改成你vps的就行了格式是 IP:端口，也就是x.x.x.x:1212
wangsmile 2014-11-25 于 12:36 回复

最后一步：Check it on your PC:
dig @X.X.X.X -p 1212 http://www.youtube.com

是在我的PC机上测试？X.X.X.X 是什么？
1. cokebar 文章作者 2014-11-25 于 12:41 回复
  
  PC机上测试需要先装dig 我博客里有一篇右边栏最上面搜dig就搜到了格式也有说明
  X.X.X.X当然是IP了猜都猜出来了
  1. wangsmile 2014-11-25 于 12:47 回复
    
    是我VPS的服务器吗？运行后：
    dig @107.X.X.X -p 1212 http://www.youtube.com
    
    ; <> DiG 9.10.1 <> @107.X.X.X -p 1212 http://www.youtube.com
    ; (1 server found)
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: FORMERR, id: 2675
    ;; flags: qr ra; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    
    ;; WARNING: EDNS query returned status FORMERR – retry with '+noedns'
    
    ;; Query time: 264 msec
    ;; SERVER: 107.X.X.X#1212(107.X.X.X)
    ;; WHEN: Tue Nov 25 12:46:05 ?D1ú±ê×?ê±?? 2014
    ;; MSG SIZE rcvd: 12
    
    X.X.X做了下注释。
    1. cokebar 文章作者 2014-11-25 于 12:51
      
      明显有问题你先在VPS上试一下，X.X.X.X换成127.0.0.1
      还有确保pdnsd成功启动了 netstat -lnp看一下有没有pdnsd在监听1212端口
    2. wangsmile 2014-11-25 于 13:07
      
      搬瓦工的VPS竟然没有DIG….安装后，运行，发现是可以的，难道是搬瓦工的VPS用啥防火墙组件了？
      dig @127.0.0.1 -p 1212 www.youtube.com
      ; <> DiG 9.7.3 <> @127.0.0.1 -p 1212 www.youtube.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 46747 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;http://www.youtube.com. IN A ;; AUTHORITY SECTION: youtube.com. 86400 IN SOA ns1.google.com. dns-admin.google.com. 1574323 10800 3600 604800 600 ;; Query time: 106 msec ;; SERVER: 127.0.0.1#1212(127.0.0.1) ;; WHEN: Tue Nov 25 00:00:26 2014 ;; MSG SIZE rcvd: 97 netstat -lnp
      Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:1212 0.0.0.0:* LISTEN 17339/pdnsd
    3. cokebar 文章作者 2014-11-25 于 13:10
      
      也不行啊没有解析结果
    4. wangsmile 2014-11-25 于 13:14
      
      刚可能复制错了。怀疑是不是搬瓦工的VPS服务器用了什么防火墙组件把1212端口屏蔽了呢？
      
      root@default:~# dig @127.0.0.1 -p 1212 http://www.youtube.com
      
      ; <> DiG 9.7.3 <> @127.0.0.1 -p 1212 http://www.youtube.com
      ; (1 server found)
      ;; global options: +cmd
      ;; Got answer:
      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60146
      ;; flags: qr rd ra; QUERY: 1, ANSWER: 12, AUTHORITY: 0, ADDITIONAL: 0
      
      ;; QUESTION SECTION:
      ;www.youtube.com. IN A
      
      ;; ANSWER SECTION:
      http://www.youtube.com. 85931 IN CNAME youtube-ui.l.google.com.
      youtube-ui.l.google.com. 85931 IN A 74.125.239.167
      youtube-ui.l.google.com. 85931 IN A 74.125.239.169
      youtube-ui.l.google.com. 85931 IN A 74.125.239.168
      youtube-ui.l.google.com. 85931 IN A 74.125.239.174
      youtube-ui.l.google.com. 85931 IN A 74.125.239.164
      youtube-ui.l.google.com. 85931 IN A 74.125.239.162
      youtube-ui.l.google.com. 85931 IN A 74.125.239.160
      youtube-ui.l.google.com. 85931 IN A 74.125.239.161
      youtube-ui.l.google.com. 85931 IN A 74.125.239.165
      youtube-ui.l.google.com. 85931 IN A 74.125.239.163
      youtube-ui.l.google.com. 85931 IN A 74.125.239.166
      
      ;; Query time: 0 msec
      ;; SERVER: 127.0.0.1#1212(127.0.0.1)
      ;; WHEN: Tue Nov 25 00:13:05 2014
      ;; MSG SIZE rcvd: 243
    5. wangsmile 2014-11-25 于 17:41
      
      咋办？服务器可以。本PC机就不行。
    6. Li Yi-Fei 2014-11-27 于 02:07
      
      之前是好的，现在遇到跟你一样的问题，奇怪的是我在路由器上dig 我的搬瓦工上面的PDNSD，报告格式错误。status: FORMERR
      
      但是在路由下面的PC windows或者linux的DIG都是好的。。百思不得其解
    7. wangsmile 2014-11-27 于 21:32
      
      我VPS服务器DIG正常，本机PC不正常，请问你是怎么解决的？
    8. Li Yi-Fei 2014-11-27 于 02:09
      
      查到一种可能性但是试验过无效。
      
      ignore_cd=(on|off);
      New in version 1.2.8: This option lets you specify that the CD
      bit of a DNS query will be ignored. Otherwise pdnsd will reply
      FORMERR to clients that set this bit in a query. It is safe to
      enable this option, as the CD bit refers to ‘Checking Disabled’
      which means that the client will accept non-authenticated data.
      This option is on by default. Turn it off if you want the old
      behaviour (before version 1.2.8).
    9. Li Yi-Fei 2014-11-27 于 02:28
      
      打开debug看日志，找到原因了，但是不知道怎么解决，猜测是OP的DIG有问题
      
      If a client announces edns0 support on the query to pdnsd, it fails:
      
      (from the log:)
      Query has a non-empty additional section!
      Outbound msg len 12, tc=0, rc=”query format error”
      
      The libc resolver doesn’t retry queries without the additional section (which
      could also be considered a bug…,) making pdnsd’s behaviour troublesome.
    10. Li Yi-Fei 2014-11-27 于 03:53
      
      搞定把debian源切换到testing http://chuansongme.com/n/506449
      
      然后安装新版本的PDNSD 1.29 就没问题了，应该还是跟CD flag有关。老版本为什么不行，还需要研究。
    11. wangsmile 2014-11-27 于 22:01
      
      你dig @搬瓦工IP有回应？我怎么没有回应呢。
      
      我根据上面的警告提示，加了参加 +noedns 返回又是成功的，这怎么回事？
    12. myliyifei 2014-11-27 于 22:24
      
      我把过程写得那么详细了，我不想回复你了。完全不看
    13. cokebar 文章作者 2014-11-28 于 01:19
      
      Edns query是1.29新功能
    14. wangsmile 2014-12-02 于 15:48
      
      不好意思，不是没看你的内容，只是因为使用+noedns参数就可以DIG测试成功了，即使不加参数也不影响使用，反正只是测试嘛。我看你的改源的升级有点担心，我怕把我VPS搞乱了。
2. cokebar 文章作者 2014-11-28 于 01:22 回复
  
  我那篇openwrt配置pdnsd文章里例子里面开了edns，这篇里服务端没开，可能是因为这个。server section加入edns_query=yes;
  1. wangsmile 2014-11-28 于 11:56 回复
    
    反正不加参数的话，我在本机DIG是上面所述，不过，用自己VPS架的DNS服务器，使用方案一，仍然是成功的。感谢了！
wangsmile 2014-12-02 于 15:46 回复

有没有安全升级pdnsd到1.29版本的方法呢，debian源切换，这个好像是测试版，看贴子里好麻烦，怕把VPS搞乱了。。。
1. Li Yi-Fei 2014-12-02 于 15:57 回复
  
  我的加了你的参数，还是不行。可能跟DIG版本也有关。我的改testing的方法 pin住了版本的，指定升级
  1. wangsmile 2014-12-02 于 18:20 回复
    
    感谢！我先用着，如果不行再升级。