🌐 Как настроить постоянный DNS-резолвер

Настроим постоянный DNS-резольвер с помощью systemd resolver или обработчика информации сервера имен.

systemd resolver

Проверьте состояние службы systemd-resolved.

$ systemctl status systemd-resolved.service 

● systemd-resolved.service - Network Name Resolution
     Loaded: loaded (/lib/systemd/system/systemd-resolved.service; disabled; vendor preset: enabled)
     Active: inactive (dead)
       Docs: man:systemd-resolved.service(8)
             man:org.freedesktop.resolve1(5)
             https://www.freedesktop.org/wiki/Software/systemd/writing-network-configuration-managers
             https://www.freedesktop.org/wiki/Software/systemd/writing-resolver-clients

Обновление конфигурации службы.

$ sudoedit /etc/systemd/resolved.conf 

#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.
#
# Entries in this file show the compile time defaults.
# You can change settings by editing this file.
# Defaults can be restored by simply deleting this file.
#
# See resolved.conf(5) for details

[Resolve]
# Some examples of DNS servers which may be used for DNS= and FallbackDNS=:
# Cloudflare: 1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001
# Google:     8.8.8.8 8.8.4.4 2001:4860:4860::8888 2001:4860:4860::8844
# Quad9:      9.9.9.9 2620:fe::fe
DNS=10.10.0.1
#FallbackDNS=
Domains=example.org
#DNSSEC=no
#DNSOverTLS=no
#MulticastDNS=yes
#LLMNR=yes
#Cache=yes
#DNSStubListener=yes
#DNSStubListenerExtra=
#ReadEtcHosts=yes
#ResolveUnicastSingleLabel=no

Запустите и включите службу systemd-resolved.

$ sudo systemctl enable --now systemd-resolved.service

Created symlink /etc/systemd/system/dbus-org.freedesktop.resolve1.service → /lib/systemd/system/systemd-resolved.service.
Created symlink /etc/systemd/system/multi-user.target.wants/systemd-resolved.service → /lib/systemd/system/systemd-resolved.service.

Проверьте состояние службы.

$ systemctl status  systemd-resolved.service 

● systemd-resolved.service - Network Name Resolution
     Loaded: loaded (/lib/systemd/system/systemd-resolved.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2021-09-27 22:43:43 CEST; 16s ago
       Docs: man:systemd-resolved.service(8)
             man:org.freedesktop.resolve1(5)
             https://www.freedesktop.org/wiki/Software/systemd/writing-network-configuration-managers
             https://www.freedesktop.org/wiki/Software/systemd/writing-resolver-clients
   Main PID: 1093 (systemd-resolve)
     Status: "Processing requests..."
      Tasks: 1 (limit: 1105)
     Memory: 4.1M
        CPU: 46ms
     CGroup: /system.slice/systemd-resolved.service
             └─1093 /lib/systemd/systemd-resolved

Проверьте созданный файл resolv.conf.

$ cat /etc/resolv.conf

# This file is managed by man:systemd-resolved(8). Do not edit.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "resolvectl status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.53
options edns0 trust-ad
search example.org

Используйте утилиту resolvectl для отображения глобальных и индивидуальных настроек DNS.

$ resolvectl status

Global
         Protocols: +LLMNR +mDNS -DNSOverTLS DNSSEC=no/unsupported
  resolv.conf mode: stub
Current DNS Server: 10.10.0.1
       DNS Servers: 10.10.0.1
        DNS Domain: example.org

Link 2 (eth0)
Current Scopes: LLMNR/IPv4 LLMNR/IPv6
     Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

Используйте утилиту resolvectl для запроса DNS-резольвера.

$ resolvectl query linux.org

linux.org: 2606:4700:3033::6815:eaa            -- link: eth0
           2606:4700:3031::ac43:a015           -- link: eth0
           104.21.14.170                       -- link: eth0
           172.67.160.21                       -- link: eth0

-- Information acquired via protocol DNS in 24.1ms.
-- Data is authenticated: no

Обработчик информации о сервере имен

Обработчик информации о сервере имен предоставляется дополнительным пакетом.

$ apt info resolvconf

Package: resolvconf
Version: 1.87
Priority: optional
Section: net
Maintainer: resolvconf team <team+resolvconf@tracker.debian.org>
Installed-Size: 204 kB
Depends: lsb-base (>= 4.1+Debian3), debconf (>= 0.5) | debconf-2.0
Breaks: dhcp3-client (<< 4.1.1-P1-15+squeeze1), dnscache-run, sysv-rc (<< 2.88dsf-42)
Enhances: dhcpcd, dnsmasq, ifupdown, isc-dhcp-client, libc6, network-manager, nscd, pdnsd, ppp, pump, udhcpc
Homepage: http://alioth.debian.org/projects/resolvconf/
Tag: admin::configuring, interface::commandline, network::configuration,
 protocol::dns, role::program, use::configuring
Download-Size: 72.7 kB
APT-Sources: http://ftp.task.gda.pl/debian bullseye/main amd64 Packages
Description: name server information handler
 Resolvconf is a framework for keeping up to date the system's
 information about name servers. It sets itself up as the intermediary
 between programs that supply this information (such as ifup and
 ifdown, DHCP clients, the PPP daemon and local name servers) and
 programs that use this information (such as DNS caches and resolver
 libraries).
 .
 This package may require some manual configuration. Please
 read the README file for detailed instructions.
</team+resolvconf@tracker.debian.org>

Установите пакет resolvconf.

$ sudo apt install resolvconf

Проверьте конфигурационные файлы.

$ ls -l /etc/resolvconf/resolv.conf.d/

total 8
-rw-r--r-- 1 root root   0 Sep 28 00:07 base
-rw-r--r-- 1 root root 275 Sep 28 00:07 head
-rw-r--r-- 1 root root  43 Sep 28 00:05 original
-rw-r--r-- 1 root root   0 Sep 28 00:06 tail

Исходный файл является лишь резервной копией, поэтому вы можете восстановить конфигурацию по своему усмотрению.

$ cat /etc/resolvconf/resolv.conf.d/original 

domain lan
search lan
nameserver 10.10.0.1

Остальные файлы используются для построения конфигурационного файла resolv.conf.

Он строится с использованием head в качестве заголовка файла, конфигурации интерфейса (статического или dhcp), base и tail в конце.

Вы можете создать ссылку из tail на исходный файл, чтобы включить в него сгенерированный файл.

$ cat /etc/resolvconf/resolv.conf.d/head 

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
# 127.0.0.53 is the systemd-resolved stub resolver.
# run "resolvectl status" to see details about the actual nameservers.

Включите resolvconf при загрузке и запустите его:

$ sudo  systemctl enable --now resolvconf

Synchronizing state of resolvconf.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable resolvconf
Created symlink /etc/systemd/system/sysinit.target.wants/resolvconf.service → /lib/systemd/system/resolvconf.service.

Проверьте состояние службы:

$ systemctl status resolvconf

● resolvconf.service - Nameserver information manager
     Loaded: loaded (/lib/systemd/system/resolvconf.service; enabled; vendor preset: enabled)
     Active: active (exited) since Tue 2021-09-28 00:36:52 CEST; 1min 23s ago
       Docs: man:resolvconf(8)
    Process: 641 ExecStart=/sbin/resolvconf --enable-updates (code=exited, status=0/SUCCESS)
   Main PID: 641 (code=exited, status=0/SUCCESS)
        CPU: 1ms

Проверьте конфигурацию, созданную для DNS-резольвера.

$ cat /etc/resolv.conf 

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
# 127.0.0.53 is the systemd-resolved stub resolver.
# run "resolvectl status" to see details about the actual nameservers.

nameserver 10.10.0.1
search lan

Обратите внимание, это будет ссылка.

$ ls -l /etc/resolv.conf 

lrwxrwxrwx 1 root root 29 Sep 27 23:12 /etc/resolv.conf -> ../run/resolvconf/resolv.conf

При необходимости добавьте дополнительную конфигурацию DNS в интерфейс.

Обратите внимание, что для этого требуется утилита resolvconf.

$ sdoedit /etc/network/interfaces.d/eth0

# The primary network interface
allow-hotplug eth0

## static address
#iface eth0 inet static
#address 10.10.1.9
#netmask 255.255.0.0
#gateway 10.10.0.1
#dns-nameserver 10.10.0.2
#dns-search example.net

## dynamic dhcp address
iface eth0 inet dhcp
dns-nameserver 10.10.0.2
dns-search example.net

Перезагрузите операционную систему.

Проверьте конфигурацию, созданную для DNS-резольвера.

Конфигурация из DHCP и файл интерфейсов были объединены.

$ cat /etc/resolv.conf 

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
# 127.0.0.53 is the systemd-resolved stub resolver.
# run "resolvectl status" to see details about the actual nameservers.

nameserver 10.10.0.2
nameserver 10.10.0.1
search example.net lan

Вы можете просмотреть исходные данные, использованные для создания вышеуказанной конфигурации.

$ cat /var/run/resolvconf/interface/eth0.inet 

search example.net
nameserver 10.10.0.2

$ cat /var/run/resolvconf/interface/eth0.dhclient 

domain lan
nameserver 10.10.0.1

Вы можете переопределить resolvconf DHCP client hook, чтобы отключить использование данных от агента DHCP, но это требует перезагрузки операционной системы.

$ echo "make_resolv_conf() { : ; }" | sudo tee /etc/dhcp/dhclient-enter-hooks.d/resolvconf-disable

Добавьте дополнительную конфигурацию.

$ cat /etc/resolvconf/resolv.conf.d/base 

nameserver 8.8.8.8

Создайте новую конфигурацию для DNS-резольвера.

$ sudo resolvconf -u

Проверьте конфигурацию, созданную для DNS-резольвера.

$ cat /etc/resolv.conf 

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
# 127.0.0.53 is the systemd-resolved stub resolver.
# run "resolvectl status" to see details about the actual nameservers.

nameserver 10.10.0.2
nameserver 8.8.8.8
search example.net

Дополнительные примечания

Эти утилиты не являются взаимоисключающими, вы можете использовать обработчик информации сервера имен для добавления дополнительных конфигураций.