有时候防攻击，在上游设定了 UDP 过滤导致 dns 无法解析， 这时候需要透过 正常能正常 UDP 通信IP的DNS 转发来解决这个问题。

可能需要在防火墙上对常用的几个 dns server ip  53 端口劫持到我们的转发服务器 53 端口。

Unbound

yum install unbound -y 
cat>/etc/unbound/unbound.conf<<EOF
server:
    interface: 0.0.0.0  # 监听所有接口
    access-control: 0.0.0.0/0 allow  # 允许所有来源的请求

    local-data: "a.com. IN A 10.0.0.1"  # 自定义解析记录

forward-zone:
    name: "."
    forward-addr: 1.1.1.1  # 上游 DNS 服务器
    forward-addr: 8.8.8.8
EOF
systemctl start unbound

Dnsmasq

yum install dnsmasq -y 
cat>/etc/dnsmasq.conf<<EOF
server=1.1.1.1  # 设置上游 DNS 服务器
server=8.8.8.8
address=/a.com/10.0.0.1  # 将 a.com 指定到 10.0.0.1
EOF
systemctl start dnsmasq

另外还有 bind和Knot DNS， 之前用过 DNSDIST 感觉不太好用。

将 1.1.1.1的 dns 劫持到指定 dns 服务器

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" destination address="1.1.1.1" port port="53" protocol="udp" forward-port port="53" protocol="udp" to-addr="10.0.0.2"'
firewall-cmd --reload

 将所有 53 端口劫持

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="53" protocol="udp" forward-port port="53" protocol="udp" to-addr="10.0.0.2"'
firewall-cmd --reload

劫持本机

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" destination port port="53" protocol="udp" forward-port port="53" protocol="udp" to-addr="10.0.0.2"'

iptables 处理对 br0 网桥的劫持

iptables -t nat -A PREROUTING -i br0 -p udp --dport 53 -j DNAT --to-destination 10.0.0.2:53

Cisco PBR路由

ip access-list extended DNS-REDIRECT
 permit udp any any eq 53
!

route-map DNS-REDIRECT permit 10
 match ip address DNS-REDIRECT
 set ip next-hop 10.0.0.2
!

interface GigabitEthernet0/0/0
 ip policy route-map DNS-REDIRECT

华为设备PBR实现

acl number 3000
 rule 5 permit udp destination-port eq 53
!
policy-based-route DNS-REDIRECT
 rule 5 permit
  if-match acl 3000
  apply ip-address next-hop 10.0.0.2
!
interface GigabitEthernet1/0/0
 ip policy-based-route DNS-REDIRECT
!

华为设备Traffic Behavior实现

acl number 3000
 rule 5 permit udp destination-port eq 53

traffic classifier DNS-CLASSIFIER operator or
 if-match acl 3000

traffic behavior DNS-BEHAVIOR
 redirect ip-nexthop 10.0.0.2

traffic policy DNS-POLICY
 classifier DNS-CLASSIFIER behavior DNS-BEHAVIOR

interface GigabitEthernet1/0/0
 traffic-policy DNS-POLICY inbound