3.3. Set up name resolution

While the DHCP server decides which MAC gets which IP, we want a way to use more human readable names for our server. This requires us to setup a mapping between the human readable names, such as c01.mgmt, and their IP addresses.

For smaller systems, it can be enough to only set up a /etc/hosts file to resolve host names to IPs. Edit /etc/hosts to add c01 and c02 hostnames.

# Loopback entries; do not change.
# For historical reasons, localhost precedes localhost.localdomain:
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
# See hosts(5) for proper format and other examples:
# 192.168.1.10 foo.example.org foo
# 192.168.1.13 bar.example.org bar

192.168.1.1 c01.mgmt
192.168.1.2 c02.mgmt

After editing this file, you can easily check if resolution works by issuing a ping command:

[root@master ~]# ping c01.mgmt
PING c01.mgmt (192.168.1.1) 56(84) bytes of data.
64 bytes from c01.mgmt (192.168.1.1): icmp_seq=1 ttl=64 time=7.87 ms
64 bytes from c01.mgmt (192.168.1.1): icmp_seq=2 ttl=64 time=0.345 ms
...

This will, however, only configure name resolution on the particular host that has this file. One way is to copy this hosts file to all servers which need to be able resolve names to IP addresses.

However, with larger set ups this will quickly become cumbersome. Instead we want to configure our own DNS server, which any server in our network can then contact to ask for name resolution.

3.3.1. Forward Lookup

Remove any changes you made to /etc/hosts
Install the Berkeley Internet Name Domain (BIND) service

A commonly used DNS server implementation is the Berkeley Internet Name Domain service or BIND. It is usually available via the package manage. Install it on the master node.
```
[root@master ~]# dnf install bind bind-utils
```

Configure the named daemon

The BIND package provides the named daemon, which is a DNS server that listens to port 53. Its main configuration file can be found in /etc/named.conf.

DNS servers are a great target for outside attacks. We want to limit our DNS queries to only be accepted from the inside of our cluster networks. To do so, we define which subnets we will listen to and use them in listen-on and allow-query options.

Edit /etc/named.conf to set servicenets, add listen-on and allow-query options, and add a zone definition for the .mgmt domain.

...
acl servicenets { 192.168.0.0/20; 192.168.16.0/20; };

options {
     listen-on port 53 { localhost; servicenets; };
     allow-query     { localhost; servicenets; };
 ...
zone "mgmt." {
    type master;
    file "mgmt";
};

Create a file /var/named/mgmt with the following contents:

$TTL 300
@                       IN      SOA     master.mgmt. master.mgmt. (
                                        2018102904   ; Serial
                                        600         ; Refresh
                                        1800         ; Retry
                                        604800       ; Expire
                                        300          ; TTL
                                        )

                        IN      NS      master.mgmt.
master                  IN      A       192.168.0.1

c01                     IN      A       192.168.1.1
c02                     IN      A       192.168.1.2

Enable and start the named daemon

[root@master ~]# systemctl enable named
[root@master ~]# systemctl start named

Try resolving one of the compute node host names
```
[root@master ~]# host c01.mgmt
Host c01.mgmt not found: 3(NXDOMAIN)
```
Something is missing. We still have to tell our network stack which name server to use.

Look at the file /etc/resolv.conf. This file is automatically generated by NetworkManager.
```
[root@master ~]# cat /etc/resolv.conf
# Generated by NetworkManager
search lan
nameserver 172.16.6.1
```
Depending on your network configuration it will register a domain name server in this file. However, this one doesn’t know anything about our internal domain.

Manually edit this file to use our own DNS server
```
nameserver 192.168.0.1
```
and try again:
```
[root@master ~]# host c01.mgmt
c01.mgmt has address 192.168.1.1
```
By prepending search mgmt to /etc/resolv.conf you can even omit the domain name (.mgmt) completely.
```
search mgmt
nameserver 192.168.0.1
```
```
[root@master ~]# host c01
c01.mgmt has address 192.168.1.1
```
Our internal DNS server is now functioning. We want outside DNS requests to be forwarded to our external DNS server. Add the forwarders line to your named configuration.
```
acl servicenets { 192.168.0.0/20; 192.168.16.0/20; };

options {
     listen-on port 53 { localhost; servicenets; };
     allow-query     { localhost; servicenets; };
     forwarders { 172.16.6.1; };
 ...
```
```
[root@master ~]# host google.com
google.com has address 172.217.4.206
google.com has IPv6 address 2607:f8b0:4009:806::200e
google.com mail is handled by 10 smtp.google.com.
```
All of these changes to /etc/resolv.conf are temporary and will not survive a reboot. To make them persistent, we need to modify our network configuration scripts accordingly to achieve the same effect.
Correct your network configuration to use the local name server

Add the following lines to your eno2 interface configuration file (i.e., /etc/NetworkManager/system-connections/eno2.nmconnection) under the ipv4 section, which is the interface connected to the management network.
```
dns=192.168.0.1
dns-search=mgmt
```
For all other interfaces (e.g., eno3) , set the following option under the ipv4 section:
```
ignore-auto-dns=true
```
This way, the interface will not “learn” new DNS servers when it gets them via DHCP and modify the /etc/resolv.conf.

Finally, restart the network manager
```
[root@master ~]# systemctl restart NetworkManager
```
and verify /etc/resolv.conf matches the following:
```
[root@master ~]# cat /etc/resolv.conf
# Generated by NetworkManager
search mgmt
nameserver 192.168.0.1
```

3.3.2. Reverse lookup

So far we’ve configured DNS to resolve human readable names into corresponding IP addresses. You can also do the reverse with DNS.

Right now this doesn’t work:

[root@master ~]# host 192.168.1.1
Host 1.1.168.192.in-addr.arpa. not found: 3(NXDOMAIN)

Reverse zone file for the IPMI subnet

Create a new zone file with the name /var/named/192.168.1 with the following contents:

$TTL 300
@                       IN      SOA     master.mgmt. master.mgmt. (
                                  2018102904   ; Serial
                                  600         ; Refresh
                                  1800         ; Retry
                                  604800       ; Expire
                                  300          ; TTL
                                  )

                        IN      NS      master.mgmt.
master                  IN      A       192.168.0.1

1    IN  PTR  c01.mgmt.;
2    IN  PTR  c02.mgmt.;

Add a new zone section in /etc/named.conf

zone "1.168.192.in-addr.arpa." {
    type master;
    file "192.168.1";
};

Restart the named daemon

[root@master ~]# systemctl restart named

Verify reverse lookup works

[root@master ~]# host 192.168.1.1
1.1.168.192.in-addr.arpa domain name pointer c01.mgmt.