Project

General

Profile

The ungleich DNS infrastructure » History » Version 22

Nico Schottelius, 03/26/2020 07:50 PM

1 1 Nico Schottelius
h1. The ungleich DNS infrastructure
2
3 6 Nico Schottelius
{{toc}}
4
5 2 Nico Schottelius
h2. Status
6
7 13 Nico Schottelius
This document is *IN PRODUCTION*.
8 2 Nico Schottelius
9 11 Nico Schottelius
h2. SEE ALSO
10
11
* [[The_ungleich_network_infrastructure]]
12
13 1 Nico Schottelius
h2. Overview
14
15 7 Nico Schottelius
16 22 Nico Schottelius
|                   | *place4*             | *place5*                          | *place6*                                                      |
17
| *DNS64 prefix*    | -                    | 2a0a:e5c0:0:1::/96                | 2a0a:e5c0:2:10::/96                                           |
18
| *DNS resolver*    | -                    | 2a0a:e5c0:0:a::a 2a0a:e5c0:0:a::b | 2a0a:e5c0:2:a::a 2a0a:e5c0:2:a::b                             |
19
| *DNS64 resolvers* | -                    | -                                 | unbound1.place6.ungleich.ch (2a0a:e5c0:2:12:0:f0ff:fea9:c451) |
20
|                   |                      |                                   | unbound2.place6.ungleich.ch (2a0a:e5c0:2:12:0:f0ff:fea9:c45d) |
21
| *DNS auth BIND*   | dns1.ungleich.ch     | dns2.ungleich.ch                  | dns3.ungleich.ch                                              |
22
|                   | 2a01:4f8:150:7092::2 | 2a0a:e5c0::1                      | 2a0a:e5c0:2:1::7                                              |
23
|                   | 176.9.50.202         | 185.203.112.1                     | 185.203.114.1                                                 |
24
| *DNS auth KNOT*   | -                    | dns7.ungleich.ch                  | dns6.ungleich.ch                                              |
25 7 Nico Schottelius
26
27 1 Nico Schottelius
* Every place has 2 redundant caching nameservers.
28
* All zones have 3 authorative nameservers, located in 3 different places
29
* Important zones (like ungleich.ch) need to be resolvable, even if a place goes offline
30
** For this reason some authorative data needs to be on the caching name servers
31
** For this reason we stay with a bind9 based setup for the moment (might change in the future)
32 3 Nico Schottelius
33
h2. Architecture
34
35
In total we are running 5 servers that are responsible for caching and authorative answers:
36
37
* Authorative
38
** 1x server in place4 (bind)
39
** 1x VRRP IP of routers in place5 (bind)
40
** 1x VRRP IP of routers in place6 (bind)
41
* Caching
42
** 2x server ip of router in place5 (bind)
43
** 2x server ip of router in place6 (bind)
44
45
h2. How to update the ungleich DNS servers
46 1 Nico Schottelius
47 12 Nico Schottelius
To update all servers, use:
48 1 Nico Schottelius
49 3 Nico Schottelius
<pre>
50 12 Nico Schottelius
cdist config d{1..7}.ungleich.ch
51 3 Nico Schottelius
</pre>
52
53 17 Nico Schottelius
|    |                  | "virtual"        | Note       |
54
| d1 | router1.place5   | dns2.ungleich.ch | cache+auth |
55
| d2 | router2.place5   | dns2.ungleich.ch | cache+auth |
56
| d3 | router1.place6   | dns3.ungleich.ch | cache+auth |
57
| d4 | router2.place6   | dns3.ungleich.ch | cache+auth |
58
| d5 | server1.place4   | dns1.ungleich.ch | auth       |
59
| d6 | dns6.ungleich.ch | -                | auth+synth |
60
| d7 | dns7.ungleich.ch | -                | auth+synth |
61
62
63 4 Nico Schottelius
h2. How to use the authorative DNS servers in zone files
64 3 Nico Schottelius
65
Add the following to your zone file:
66
67
<pre>
68 5 Nico Schottelius
    ; server1.place4
69
    IN NS dns1.ungleich.ch.
70
71
    ; vrrp active router @ place5
72
    IN NS dns2.ungleich.ch.
73
    
74
    ; vrrp active router @ place6
75
    IN NS dns3.ungleich.ch.
76 18 Timothée Floure
</pre>
77
78
h2. DNS64 at datacenterlight/ipv6onlyhosting
79
80 20 Timothée Floure
"NAT64":https://en.wikipedia.org/wiki/NAT64 allows ipv6-only nodes to reach the v4 world, and requires DNS64 at ungleich.
81 1 Nico Schottelius
82 20 Timothée Floure
h3. DNS64 resolvers
83
84
DNS64 is usually provided by BIND (d{1..7}.ungleich.ch) depending on the address/prefix emitting the request (see `type/__ungleich_dns_server` in dot-cdist). It can also be provided by the unbound servers of place6 (unbound{1,2}.place6.ungleich.ch), which unconditionally serve DNS64.
85
86
h3. Customer VMS
87
88
The production infrastructure for DCL/V6OnlyHosting runs at place6 and networks are assigned as follow:
89
90 18 Timothée Floure
* IPv6Only VMs are assigned to the `place6-ipv6-nat64` OpenNebula network.
91
* Dual-stack VM are assigned to the `place6-ipv4` and `place6-ipv6`
92
93 1 Nico Schottelius
The `place6-ipv6-nat64` networks *provides NAT64* but the `place6-ipv6` *does not*: we do not want ipv4-capable VMs to be NAT'ed behind NAT64. Due to *legacy reasons*, some ipv6only VMs are in `place6-ipv6` but have NAT64 due to hardcoded per-ip configuration our bind DNS server (see `type/__ungleich_dns_server` type in dot-cdist).
94 18 Timothée Floure
95 20 Timothée Floure
h4. place6-ipv6-with-ip-spoofing
96 18 Timothée Floure
97
This OpenNebula network is used to routes v6 prefixes (/64, /56, /48) to customer VMs and is shared by Ipv6-Only and Dual-Stack VMs: NAT64 is *disabled* on this network. IPv6-Only customers on this network *MUST* use unbound1.place6.ungleich.ch and unbound2.place6.ungleich.ch as name server. Their `/etc/resolve.conf` file should look like:
98
99
<pre>
100
nameserver 2a0a:e5c0:2:12:0:f0ff:fea9:c451
101 1 Nico Schottelius
nameserver 2a0a:e5c0:2:12:0:f0ff:fea9:c45d
102
</pre>
103 20 Timothée Floure
104
h3. DNS64 in Ungleich IPv6 VPN
105
106 21 Timothée Floure
Using ungleich's DNS64 resolvers also allows to route all traffic via the ungleich VPN when enabled. You'll find more details on the [[Ungleich IPv6 wireguard VPN]] page.
107
108 19 Timothée Floure
109
h2. Monitoring
110
111
The unbound DNS64 resolvers are monitored by our prometheus blackbox exporter (see `type/__dcl_monitoring_server` in dot-cdist).