💡 network dns stubby 핵심 가이드 및 실전 아키텍처 핵심 요약 (Executive Summary)
본 가이드는 network dns stubby 핵심 가이드 및 실전 아키텍처의 핵심 개념, 구성 아키텍처 및 실무 엔지니어링 베스트 프랙티스를 체계적으로 정리했습니다.
📑 Table of Contents
Architecture
Architecture & System Flow
Diagram
Pan & Zoom
Installation
Mac
bash
brew install stubby jq yqExec
Configuration
bash
vi /opt/homebrew/etc/stubby/stubby.ymlDaemon으로 실행
bash
sudo brew services start stubby
sudo brew services stop stubbyCmd로 실행
bash
sudo stubby -l &
sudo kill $(pidof stubby)Features
stubby endpoint: 127.0.0.1:53
bash
sudo lsof -i :53인터페이스 레벨에서 Stubby DNS 지정
- Setting → TCP/IP → DNS → 127.0.0.1 등록
bash
DNS=127.0.0.1
DEFAULT_IFACE=$(route -n get default | awk '/interface: / {print $2}')
INTERFACE=$(networksetup -listnetworkserviceorder | grep -B 1 "Device: $DEFAULT_IFACE" | head -n 1 | sed 's/.*) //')
if [ -z "$INTERFACE" ]; then
echo "활성 네트워크 서비스를 찾을 수 없습니다."
else
sudo networksetup -setdnsservers "$INTERFACE" $DNS
echo "성공: [$INTERFACE]의 DNS를 ${DNS}로 설정했습니다."
fi리졸버 구성: Domain 분기 Stubby DNS 지정
bash
domain=hanacloudia.com
sudo mkdir -p /etc/resolver
cat <<EOF | sudo tee /etc/resolver/$domain
nameserver 127.0.0.1
EOF
scutil --dnsDoT 활성화 (v1)
- DoT 검증:
bash
dns_domain=dns.okestro.hanacloudia.com
dns_ip=10.255.57.88
cafile=~/Downloads/ca.crt
cp $cafile /opt/homebrew/etc/stubby/ca.crt
export upstream_recursive_servers=$(cat << EOF | yq -pyaml -ojson | jq '.temps'
temps:
- address_data: $dns_ip
tls_auth_name: "$dns_domain"
tls_port: 853
tls_ca_file: "./ca.crt"
EOF
)
yq -i ".upstream_recursive_servers = $upstream_recursive_servers" \
/opt/homebrew/etc/stubby/stubby.yml
sudo brew services restart stubbyDoT 활성화 (v2)
bash
#dns소속 k8s에서
pubkey_sha256=$(kubectl get secret -n management-system dns.okestro.hanacloudia.com-tls -o=jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -pubkey -noout | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64)
dns_domain=dns.okestro.hanacloudia.com
dns_ip=10.255.57.88
cafile=~/Downloads/ca.crt
cp $cafile /opt/homebrew/etc/stubby/ca.crt
export upstream_recursive_servers=$(cat << EOF | yq -pyaml -ojson | jq '.temps'
temps:
- address_data: $dns_ip
tls_auth_name: "$dns_domain"
tls_port: 853
tls_pubkey_pinset:
- digest: "sha256"
value: "$pubkey_sha256"
EOF
)
yq -i ".upstream_recursive_servers = $upstream_recursive_servers" \
/opt/homebrew/etc/stubby/stubby.yml
sudo brew services restart stubby기존 DNS캐시 삭제
bash
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
Leave a Reply