Open Infrastructure

Background¶

We want VPN users or anyone to be able to select if they get NAT64 or not. Currently our bind decides based on the query source IP, whether to provide NAT64 or not and which prefix to use.

We want to have an alternative to that: DNS servers that always respond with NAT64 replies. So users can decide on their own if they want NAT64 or not.

Details¶

• 2 VMs in place6
  • names: unbound1.place6.ungleich.ch, unbound2.place6.ungleich.ch
• OS: Alpine
• fully cdist configured
  • create a new type __ungleich_unbound that accepts as parameter:
    • upstream dns servers
    • dns64 prefix
• Use the DNS64 prefix from place6
• Configure unbound to lookup names via 2a0a:e5c0:2:1::5 and 2a0a:e5c0:2:1::6
  • Because unbound is IPv6 only, it is not able to query IPv4 only domains

documentation¶

• After it has been implemented and verified by Balazs, please update the documentation on The_ungleich_DNS_infrastructure