The ungleich DNS infrastructure¶

• Table of contents
• The ungleich DNS infrastructure
  • Status
  • SEE ALSO
  • Overview
  • Architecture
  • How to update the ungleich DNS servers
  • How to use the authorative DNS servers in zone files
  • DNS64 at datacenterlight/ipv6onlyhosting
    • place6-ipv6-with-ip-spoofing
  • Monitoring

Status¶

This document is IN PRODUCTION.

SEE ALSO¶

• The_ungleich_network_infrastructure

Overview¶

	place4	place5	place6
DNS64 prefix	-	2a0a:e5c0:0:1::/96	2a0a:e5c0:2:10::/96
DNS resolver	-	2a0a:e5c0::3 2a0a:e5c0::4	2a0a:e5c0:2:1::5 2a0a:e5c0:2:1::6
DNS64 resolvers	-	-	unbound1.place6.ungleich.ch (2a0a:e5c0:2:12:0:f0ff:fea9:c451) unbound2.place6.ungleich.ch (2a0a:e5c0:2:12:0:f0ff:fea9:c45d)
DNS auth BIND	dns1.ungleich.ch	dns2.ungleich.ch	dns3.ungleich.ch
	2a01:4f8:150:7092::2	2a0a:e5c0::1	2a0a:e5c0:2:1::7
	176.9.50.202	185.203.112.1	185.203.114.1
DNS auth KNOT	-	dns7.ungleich.ch	dns6.ungleich.ch

• Every place has 2 redundant caching nameservers.
• All zones have 3 authorative nameservers, located in 3 different places
• Important zones (like ungleich.ch) need to be resolvable, even if a place goes offline
  • For this reason some authorative data needs to be on the caching name servers
  • For this reason we stay with a bind9 based setup for the moment (might change in the future)

Architecture¶

In total we are running 5 servers that are responsible for caching and authorative answers:

• Authorative
  • 1x server in place4 (bind)
  • 1x VRRP IP of routers in place5 (bind)
  • 1x VRRP IP of routers in place6 (bind)
• Caching
  • 2x server ip of router in place5 (bind)
  • 2x server ip of router in place6 (bind)

How to update the ungleich DNS servers¶

To update all servers, use:

cdist config d{1..7}.ungleich.ch

		"virtual"	Note
d1	router1.place5	dns2.ungleich.ch	cache+auth
d2	router2.place5	dns2.ungleich.ch	cache+auth
d3	router1.place6	dns3.ungleich.ch	cache+auth
d4	router2.place6	dns3.ungleich.ch	cache+auth
d5	server1.place4	dns1.ungleich.ch	auth
d6	dns6.ungleich.ch	-	auth+synth
d7	dns7.ungleich.ch	-	auth+synth

How to use the authorative DNS servers in zone files¶

Add the following to your zone file:

    ; server1.place4
    IN NS dns1.ungleich.ch.

    ; vrrp active router @ place5
    IN NS dns2.ungleich.ch.

    ; vrrp active router @ place6
    IN NS dns3.ungleich.ch.

DNS64 at datacenterlight/ipv6onlyhosting¶

NAT64 allows ipv6-only nodes to reach the v4 world. The production infrastructure for DCL/V6OnlyHosting runs at place6 and networks are assigned as follow:

• IPv6Only VMs are assigned to the `place6-ipv6-nat64` OpenNebula network.
• Dual-stack VM are assigned to the `place6-ipv4` and `place6-ipv6`

The `place6-ipv6-nat64` networks provides NAT64 but the `place6-ipv6` does not: we do not want ipv4-capable VMs to be NAT'ed behind NAT64. Due to legacy reasons, some ipv6only VMs are in `place6-ipv6` but have NAT64 due to hardcoded per-ip configuration our bind DNS server (see `type/__ungleich_dns_server` type in dot-cdist).

place6-ipv6-with-ip-spoofing¶

This OpenNebula network is used to routes v6 prefixes (/64, /56, /48) to customer VMs and is shared by Ipv6-Only and Dual-Stack VMs: NAT64 is disabled on this network. IPv6-Only customers on this network MUST use unbound1.place6.ungleich.ch and unbound2.place6.ungleich.ch as name server. Their `/etc/resolve.conf` file should look like:

nameserver 2a0a:e5c0:2:12:0:f0ff:fea9:c451
nameserver 2a0a:e5c0:2:12:0:f0ff:fea9:c45d

Monitoring¶

The unbound DNS64 resolvers are monitored by our prometheus blackbox exporter (see `type/__dcl_monitoring_server` in dot-cdist).