DNS / DHCP 서비스

이 기사에서는 경량 dnsmasq 솔루션과 모든 기능을 갖춘 BIND9 및 isc-dhcp-server 접근 방식을 포함하여 Ubuntu 26.04에서 DNS 및 DHCP 서비스를 설정하는 방법을 설명합니다.

dnsmasq (경량 DNS + DHCP)

dnsmasq는 DNS 캐싱/전달 및 DHCP 서비스를 모두 제공하므로 소규모 네트워크 및 홈 랩 환경에 이상적입니다.

설치 및 구성


# Ubuntu 26.04 uses systemd-resolved by default, which occupies port 53.
# Recommended (gentler) approach: only disable its DNS stub listener while
# keeping the rest of resolved's functionality.
# Edit /etc/systemd/resolved.conf and set the following in the [Resolve] section:
#   DNSStubListener=no
sudo sed -i 's/^#\?DNSStubListener=.*/DNSStubListener=no/' /etc/systemd/resolved.conf
sudo systemctl restart systemd-resolved
 
# After disabling the stub, the default /etc/resolv.conf still points at the
# now-dead 127.0.0.53, so this host loses DNS immediately (including the
# apt update below). Repoint it to resolved's own upstream results to restore
# local DNS:
sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
 
# Alternative approach (fully disable systemd-resolved):
# sudo systemctl stop systemd-resolved
# sudo systemctl disable systemd-resolved
# sudo rm /etc/resolv.conf
# echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf
 
# Install dnsmasq (local DNS is restored now, so apt update will not break)
sudo apt update
sudo apt install dnsmasq -y

DNS 구성


sudo tee /etc/dnsmasq.conf << 'EOF'
# Listen interface
interface=eth0
bind-interfaces
 
# Upstream DNS servers
server=8.8.8.8
server=1.1.1.1
 
# DNS cache size
cache-size=1000
 
# Local domain
domain=homelab.local
local=/homelab.local/
 
# Custom DNS records (similar to /etc/hosts)
address=/nas.homelab.local/192.168.1.10
address=/router.homelab.local/192.168.1.1
 
# Also read records from /etc/hosts
expand-hosts
 
# Logging (enable for debugging)
# log-queries
# log-facility=/var/log/dnsmasq.log
EOF

DHCP 구성


# Append DHCP configuration to /etc/dnsmasq.conf
sudo tee -a /etc/dnsmasq.conf << 'EOF'
 
# DHCP address pool range and lease time
dhcp-range=192.168.1.100,192.168.1.200,255.255.255.0,12h
 
# Default gateway
dhcp-option=option:router,192.168.1.1
 
# DNS server (point to self)
dhcp-option=option:dns-server,192.168.1.5
 
# NTP server
dhcp-option=option:ntp-server,192.168.1.1
 
# Domain name
dhcp-option=option:domain-name,homelab.local
 
# Static IP bindings (MAC address reservations)
dhcp-host=aa:bb:cc:dd:ee:01,server1,192.168.1.11
dhcp-host=aa:bb:cc:dd:ee:02,server2,192.168.1.12
 
# DHCP lease file
dhcp-leasefile=/var/lib/dnsmasq/dnsmasq.leases
 
# PXE boot (optional)
# dhcp-boot=pxelinux.0,pxeserver,192.168.1.5
EOF

서비스 시작


# Test the configuration
dnsmasq --test
 
# Restart the service
sudo systemctl restart dnsmasq
sudo systemctl enable dnsmasq
 
# Firewall rules
sudo ufw allow 53/tcp
sudo ufw allow 53/udp
sudo ufw allow 67/udp
sudo ufw allow 68/udp
 
# Test DNS
dig @localhost homelab.local
nslookup nas.homelab.local 127.0.0.1
 
# View DHCP leases
cat /var/lib/dnsmasq/dnsmasq.leases

BIND9(권한 있는 DNS 서버)

BIND9는 가장 널리 사용되는 DNS 서버 소프트웨어로, 전체 DNS 기능이 필요한 시나리오에 적합합니다.

설치


sudo apt update
sudo apt install bind9 bind9-utils bind9-dnsutils -y
 
sudo systemctl enable --now named

주요 구성


# /etc/bind/named.conf.options
sudo tee /etc/bind/named.conf.options << 'EOF'
options {
    directory "/var/cache/bind";
 
    // Forwarding mode
    forwarders {
        8.8.8.8;
        1.1.1.1;
    };
    forward only;
 
    // Listen addresses
    listen-on { 127.0.0.1; 192.168.1.5; };
    listen-on-v6 { none; };
 
    // Allowed query clients
    allow-query { localhost; 192.168.1.0/24; };
 
    // Allow recursive queries
    recursion yes;
    allow-recursion { localhost; 192.168.1.0/24; };
 
    // Security settings
    dnssec-validation auto;
    auth-nxdomain no;
 
    // Hide version number
    version "not available";
};
EOF

전달 영역 구성


# Add zone declarations
sudo tee /etc/bind/named.conf.local << 'EOF'
// Forward zone
zone "example.local" {
    type master;
    file "/etc/bind/zones/db.example.local";
    allow-transfer { 192.168.1.6; };  // Secondary server IP
};
 
// Reverse zone
zone "1.168.192.in-addr.arpa" {
    type master;
    file "/etc/bind/zones/db.192.168.1";
    allow-transfer { 192.168.1.6; };
};
EOF
 
# Create the zone file directory
sudo mkdir -p /etc/bind/zones

전달 영역 파일


sudo tee /etc/bind/zones/db.example.local << 'EOF'
$TTL    604800
@       IN      SOA     ns1.example.local. admin.example.local. (
                        2026032401      ; Serial (YYYYMMDD + sequence)
                        3600            ; Refresh
                        1800            ; Retry
                        604800          ; Expire
                        86400 )         ; Negative Cache TTL
 
; Name servers
@       IN      NS      ns1.example.local.
@       IN      NS      ns2.example.local.
 
; A records
ns1     IN      A       192.168.1.5
ns2     IN      A       192.168.1.6
web     IN      A       192.168.1.10
db      IN      A       192.168.1.11
mail    IN      A       192.168.1.12
 
; CNAME records
www     IN      CNAME   web.example.local.
ftp     IN      CNAME   web.example.local.
 
; MX records
@       IN      MX  10  mail.example.local.
EOF

리버스 존 파일


sudo tee /etc/bind/zones/db.192.168.1 << 'EOF'
$TTL    604800
@       IN      SOA     ns1.example.local. admin.example.local. (
                        2026032401      ; Serial
                        3600            ; Refresh
                        1800            ; Retry
                        604800          ; Expire
                        86400 )         ; Negative Cache TTL
 
@       IN      NS      ns1.example.local.
@       IN      NS      ns2.example.local.
 
; PTR records
5       IN      PTR     ns1.example.local.
6       IN      PTR     ns2.example.local.
10      IN      PTR     web.example.local.
11      IN      PTR     db.example.local.
12      IN      PTR     mail.example.local.
EOF

검증 및 시작


# Check main configuration syntax
sudo named-checkconf
 
# Check zone files
sudo named-checkzone example.local /etc/bind/zones/db.example.local
sudo named-checkzone 1.168.192.in-addr.arpa /etc/bind/zones/db.192.168.1
 
# Restart the service
sudo systemctl restart named
 
# Test resolution
dig @192.168.1.5 web.example.local
dig @192.168.1.5 -x 192.168.1.10
nslookup web.example.local 192.168.1.5

isc-dhcp-서버

고급 DHCP 기능이 필요한 대규모 네트워크 또는 시나리오의 경우 독립형 DHCP 서버를 사용하십시오.

참고: isc-dhcp-server의 수명이 종료되었습니다. ISC는 Kea DHCP로 마이그레이션할 것을 권장합니다. 두 가지 모두 아래에서 다룹니다.

isc-dhcp-서버 구성


# Install
sudo apt install isc-dhcp-server -y
 
# Specify the listening interface
sudo tee /etc/default/isc-dhcp-server << 'EOF'
INTERFACESv4="eth0"
INTERFACESv6=""
EOF


# Edit the main configuration file
sudo tee /etc/dhcp/dhcpd.conf << 'EOF'
# Global options
option domain-name "example.local";
option domain-name-servers 192.168.1.5, 8.8.8.8;
default-lease-time 43200;    # 12 hours
max-lease-time 86400;        # 24 hours
authoritative;
 
# Subnet definition
subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.100 192.168.1.200;
    option routers 192.168.1.1;
    option subnet-mask 255.255.255.0;
    option broadcast-address 192.168.1.255;
    option ntp-servers 192.168.1.1;
}
 
# Fixed IP assignments
host server1 {
    hardware ethernet aa:bb:cc:dd:ee:01;
    fixed-address 192.168.1.11;
    option host-name "server1";
}
 
host server2 {
    hardware ethernet aa:bb:cc:dd:ee:02;
    fixed-address 192.168.1.12;
    option host-name "server2";
}
 
# Group configuration (shared options)
group {
    option domain-name "dev.example.local";
 
    host dev1 {
        hardware ethernet aa:bb:cc:dd:ee:10;
        fixed-address 192.168.1.50;
    }
    host dev2 {
        hardware ethernet aa:bb:cc:dd:ee:11;
        fixed-address 192.168.1.51;
    }
}
EOF


# Check configuration syntax
sudo dhcpd -t -cf /etc/dhcp/dhcpd.conf
 
# Start the service
sudo systemctl restart isc-dhcp-server
sudo systemctl enable isc-dhcp-server
 
# View leases
cat /var/lib/dhcp/dhcpd.leases

Kea DHCP(교체 권장)


# Install Kea DHCP
sudo apt install kea-dhcp4-server -y


# Configure /etc/kea/kea-dhcp4.conf
sudo tee /etc/kea/kea-dhcp4.conf << 'EOF'
{
    "Dhcp4": {
        "interfaces-config": {
            "interfaces": ["eth0"]
        },
        "lease-database": {
            "type": "memfile",
            "persist": true,
            "name": "/var/lib/kea/dhcp4.leases"
        },
        "valid-lifetime": 43200,
        "subnet4": [
            {
                "subnet": "192.168.1.0/24",
                "pools": [
                    { "pool": "192.168.1.100 - 192.168.1.200" }
                ],
                "option-data": [
                    { "name": "routers", "data": "192.168.1.1" },
                    { "name": "domain-name-servers", "data": "192.168.1.5, 8.8.8.8" },
                    { "name": "domain-name", "data": "example.local" }
                ],
                "reservations": [
                    {
                        "hw-address": "aa:bb:cc:dd:ee:01",
                        "ip-address": "192.168.1.11",
                        "hostname": "server1"
                    }
                ]
            }
        ]
    }
}
EOF
 
sudo systemctl restart kea-dhcp4-server
sudo systemctl enable kea-dhcp4-server

DNS + DHCP 통합

DNS에 DHCP 할당 호스트 이름을 자동으로 등록합니다.

dnsmasq 접근 방식(자동)

dnsmasq는 기본적으로 DNS-DHCP 통합을 지원합니다. DHCP 클라이언트가 보낸 호스트 이름은 자동으로 확인 가능합니다.

BIND9 + DHCP 동적 업데이트


# Generate a TSIG key
tsig-keygen -a hmac-sha256 dhcp-key > /etc/bind/dhcp-key.conf
 
# Include the key in BIND and allow dynamic updates
# Add to /etc/bind/named.conf.local:
include "/etc/bind/dhcp-key.conf";
 
zone "example.local" {
    type master;
    file "/var/lib/bind/db.example.local";
    allow-update { key dhcp-key; };
};

문제 해결


# DNS troubleshooting
dig @server-ip example.local +trace
dig @server-ip example.local +short
host example.local server-ip
 
# DHCP troubleshooting
sudo journalctl -u isc-dhcp-server -f
sudo journalctl -u dnsmasq -f
 
# Check listening ports
ss -ulnp | grep -E "(53|67|68)"
 
# Capture DHCP traffic
sudo tcpdump -i eth0 port 67 or port 68 -n
 
# Manually request a DHCP lease on the client
sudo dhclient -v eth0