[root@localhost named]# cat /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//


options {
        listen-on port 53 { any; };
//      listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };
        recursion yes;


        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;


        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";


        managed-keys-directory "/var/named/dynamic";
};


logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};


controls {
        inet 127.0.0.1 
        allow { localhost ;}  keys  { rndc-key; };
};


zone "." IN {
        type hint;
        file "named.ca";
};


include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
include "/etc/rndc.key";



[root@localhost named]# cat /etc/named.rfc1912.zones




zone "05XXXan.com" IN {
        type master;
        file "05XXXan.com.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "6XXXqgd.com" IN {
        type master;
        file "6XXXqgd.com.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "fXXXjoy.com" IN {
        type master;
        file "fXXXjoy.com.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "fXXXoco.com" IN {
        type master;
        file "fXXXoco.com.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "fXXXoy2.com" IN {
        type master;
        file "fXXXoy2.com.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "fXXXoy.com" IN {
        type master;
        file "fXXXoy.com.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "localhost" IN {
        type master;
        file "localhost.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "lXXXjoy.com" IN {
        type master;
        file "lXXXjoy.com.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "pXXXijoy.com" IN {
        type master;
        file "pXXXijoy.com.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "pXXXugo.com" IN {
        type master;
        file "pXXXugo.com.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "tXXXcn.com" IN {
        type master;
        file "tXXXcn.com.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "tXXXfun.com" IN {
        type master;
        file "tXXXfun.com.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "XXXmf.net" IN {
        type master;
        file "XXXmf.net.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "XXXns.com" IN {
        type master;
        file "XXXns.com.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "XXXqq.com" IN {
        type master;
        file "XXXqq.com.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "XXXxk.com" IN {
        type master;
        file "XXXxk.com.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "XXXyy.com" IN {
        type master;
        file "XXXyy.com.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "tanXXX3.com" IN {
        type master;
        file "tanXXX3.com.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "tXXX21.com" IN {
        type master;
        file "tXXX21.com.zone";
        allow-update { none; };
        notify yes ;
        allow-transfer { 180.XXX.223.210; };
};


zone "250.XXX.222.in-addr.arpa" {
        allow-update { none; };
        type master;
        file "named.pXXXugo";
};



slave机器的 /etc/named.rfc1912.zones配置 
[root@localhost ~]# cat /etc/named.rfc1912.zones|less


zone "0XXXan.com" IN {
        type slave;
        file "05XXXan.com.zone";
        masters { 222.XXX.250.220; };
        allow-transfer { 222.XXX.250.220;};
};


zone "6cXXXgd.com" IN {
        type slave;
        file "6XXXqgd.com.zone";
        masters { 222.XXX.250.220; };
        allow-transfer { 222.XXX.250.220;};
};


zone "fs2joy.com" IN {
        type slave;
        file "fs2joy.com.zone";
        masters { 222.73.250.220; };
        allow-transfer { 222.73.250.220;};
};



文件权限
[root@localhost ~]# ll /etc/named.conf               
-rw-r-----. 1 named named 1105 Sep 21  2012 /etc/named.conf
[root@localhost ~]# ll /etc/named.rfc1912.zones
-rw-r----- 1 named named 2866 Aug  7 15:07 /etc/named.rfc1912.zones
[root@localhost ~]# ll /etc/named.root.key 
-rw-r--r--. 1 named named 487 Jul 19  2010 /etc/named.root.key
[root@localhost ~]# ll /var/named/    
total 136
-rw-r--r--  1 named named  1154 Aug 14 07:09 0XXXan.com.zone
drwxr-xr-x  2 root  root   4096 Sep 25  2012 123
-rw-r--r--  1 named named   515 Aug 14 09:28 6XXXgd.com.zone
drwxr-x---. 6 root  named  4096 Sep 20  2012 chroot
drwxrwx---. 2 named named  4096 Aug 11 03:27 data
drwxrwx---. 2 named named  4096 Aug 14 10:32 dynamic
-rw-r--r--  1 named named   524 Aug 14 09:40 fXXXjoy.com.zone
-rw-r--r--  1 named named   457 Aug 14 06:50 fXXXoco.com.zone
-rw-r--r--  1 named named   696 Aug 14 08:00 fXXXy2.com.zone
-rw-r--r--  1 named named 16902 Aug 14 06:37 fXXXoy.com.zone
-rw-r--r--  1 named named   272 Aug 14 10:15 localhost.zone
-rw-r--r--  1 named named   365 Aug 14 09:11 luXXXjoy.com.zone
-rw-r-----. 1 root  named  1892 Feb 18  2008 named.ca
-rw-r-----. 1 root  named   152 Dec 15  2009 named.empty
-rw-r--r--  1 root  root    457 Sep 24  2012 named.fXXXoy
-rw-r-----. 1 root  named   152 Jun 21  2007 named.localhost
-rw-r-----. 1 root  named   168 Dec 15  2009 named.loopback
-rw-r--r--  1 named named   880 Aug 14 07:22 pXXXaijoy.com.zone
-rw-r--r--  1 named named   355 Aug 14 08:40 puXXXgo.com.zone
drwxrwx---. 2 named named  4096 Sep 14  2012 slaves
-rw-r--r--  1 named named  5355 Aug 14 10:22 tXXXn.com.zone
-rw-r--r--  1 named named   358 Aug 14 07:06 XXXfun.com.zone
-rw-r--r--  1 named named   715 Aug 14 04:33 XXXmf.net.zone
-rw-r--r--  1 named named  2219 Aug 14 06:00 XXXns.com.zone
-rw-r--r--  1 named named   287 Aug 14 08:37 XXXqq.com.zone
-rw-r--r--  1 named named  1456 Aug 14 08:26 XXXxk.com.zone
-rw-r--r--  1 named named   444 Aug 14 07:37 tXXXyy.com.zone
-rw-r--r--  1 named named   296 Aug 14 07:15 taXXX23.com.zone
-rw-r--r--  1 named named   296 Aug 14 09:12 tanXXX1.com.zone
[root@localhost ~]# ll /var/named/chroot/var/named/
total 136
-rw-r--r--  1 named named  1154 Aug 14 07:09 0XXXan.com.zone
drwxr-xr-x  2 root  root   4096 Sep 25  2012 123
-rw-r--r--  1 named named   515 Aug 14 09:28 6XXXgd.com.zone
drwxr-x---. 6 root  named  4096 Sep 20  2012 chroot
drwxrwx---. 2 named named  4096 Aug 11 03:27 data
drwxrwx---. 2 named named  4096 Aug 14 10:32 dynamic
-rw-r--r--  1 named named   524 Aug 14 09:40 fsXXXoy.com.zone
-rw-r--r--  1 named named   457 Aug 14 06:50 fsXXXco.com.zone
-rw-r--r--  1 named named   696 Aug 14 08:00 fsXXXy2.com.zone
-rw-r--r--  1 named named 16902 Aug 14 06:37 fXXXy.com.zone
-rw-r--r--  1 named named   272 Aug 14 10:15 localhost.zone
-rw-r--r--  1 named named   365 Aug 14 09:11 lunXXXy.com.zone
-rw-r-----. 1 root  named  1892 Feb 18  2008 named.ca
-rw-r-----. 1 root  named   152 Dec 15  2009 named.empty
-rw-r--r--  1 root  root    457 Sep 24  2012 named.fXXXoy
-rw-r-----. 1 root  named   152 Jun 21  2007 named.localhost
-rw-r-----. 1 root  named   168 Dec 15  2009 named.loopback
-rw-r--r--  1 named named   880 Aug 14 07:22 paXXXoy.com.zone
-rw-r--r--  1 named named   355 Aug 14 08:40 pXXXgo.com.zone
drwxrwx---. 2 named named  4096 Sep 14  2012 slaves
-rw-r--r--  1 named named  5355 Aug 14 10:22 tXXXn.com.zone
-rw-r--r--  1 named named   358 Aug 14 07:06 tXXXfun.com.zone
-rw-r--r--  1 named named   715 Aug 14 04:33 XXXf.net.zone
-rw-r--r--  1 named named  2219 Aug 14 06:00 XXXns.com.zone
-rw-r--r--  1 named named   287 Aug 14 08:37 XXXqq.com.zone
-rw-r--r--  1 named named  1456 Aug 14 08:26 XXXxk.com.zone
-rw-r--r--  1 named named   444 Aug 14 07:37 XXXyy.com.zone
-rw-r--r--  1 named named   296 Aug 14 07:15 taXXX3.com.zone
-rw-r--r--  1 named named   296 Aug 14 09:12 tXXX21.com.zone


slave iptables配置
[root@localhost ~]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.7 on Tue Aug  7 11:01:40 2012
*nat
:PREROUTING ACCEPT [329:32530]
:POSTROUTING ACCEPT [11:795]
:OUTPUT ACCEPT [11:795]
COMMIT
# Completed on Tue Aug  7 11:01:40 2012
# Generated by iptables-save v1.4.7 on Tue Aug  7 11:01:40 2012
*filter
:INPUT DROP [126:62179]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [207:13856]
-A INPUT -d 180.xxx.223.210/32 -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT 
-A INPUT -d 180.xxx.223.210/32 -p udp -j ACCEPT 
-A INPUT -p icmp -m limit --limit 1/sec --limit-burst 10 -j ACCEPT 
-A INPUT -i lo -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -s 222.xxx.250.182/32 -d 180.153.223.210/32 -i eth0 -p tcp -m tcp --dport 33 -j ACCEPT 
-A INPUT -s 61.xxx.92.208/32 -d 180.153.223.210/32 -i eth0 -p tcp -m tcp --dport 33 -j ACCEPT 
-A INPUT -s 222.xxx.172.190/32 -d 180.153.223.210/32 -i eth0 -p tcp -m tcp --dport 33 -j ACCEPT 
COMMIT
# Completed on Tue Aug  7 11:01:40 2012