Project

General

Profile

The ungleich DNS infrastructure » History » Version 24

Nico Schottelius, 02/15/2021 11:09 AM

1 1 Nico Schottelius
h1. The ungleich DNS infrastructure
2
3 6 Nico Schottelius
{{toc}}
4
5 2 Nico Schottelius
h2. Status
6
7 13 Nico Schottelius
This document is *IN PRODUCTION*.
8 2 Nico Schottelius
9 11 Nico Schottelius
h2. SEE ALSO
10
11
* [[The_ungleich_network_infrastructure]]
12
13 1 Nico Schottelius
h2. Overview
14
15 7 Nico Schottelius
16 23 Nico Schottelius
|                       | *place4*             | *place5*                          | *place6*                                                      |
17
| *DNS64 prefix*        | -                    | 2a0a:e5c0:0:1::/96                | 2a0a:e5c0:2:10::/96                                           |
18
| *DNS resolver*        | -                    | 2a0a:e5c0:0:a::a 2a0a:e5c0:0:a::b | 2a0a:e5c0:2:a::a 2a0a:e5c0:2:a::b                             |
19
| (NAT64 enabled        |                      |                                   |                                                               |
20
| for certain networks) |                      |                                   |                                                               |
21
|                       |                      |                                   |                                                               |
22
| *DNS64 resolvers*     | -                    | -                                 | unbound1.place6.ungleich.ch (2a0a:e5c0:2:12:0:f0ff:fea9:c451) |
23
|                       |                      |                                   | unbound2.place6.ungleich.ch (2a0a:e5c0:2:12:0:f0ff:fea9:c45d) |
24
| *DNS auth BIND*       | dns1.ungleich.ch     | dns2.ungleich.ch                  | dns3.ungleich.ch                                              |
25
|                       | 2a01:4f8:150:7092::2 | 2a0a:e5c0::1                      | 2a0a:e5c0:2:1::7                                              |
26
|                       | 176.9.50.202         | 185.203.112.1                     | 185.203.114.1                                                 |
27
| *DNS auth KNOT*       | -                    | dns7.ungleich.ch                  | dns6.ungleich.ch                                              |
28 7 Nico Schottelius
29
30 1 Nico Schottelius
* Every place has 2 redundant caching nameservers.
31
* All zones have 3 authorative nameservers, located in 3 different places
32
* Important zones (like ungleich.ch) need to be resolvable, even if a place goes offline
33
** For this reason some authorative data needs to be on the caching name servers
34
** For this reason we stay with a bind9 based setup for the moment (might change in the future)
35 3 Nico Schottelius
36
h2. Architecture
37
38 24 Nico Schottelius
In total we are running 8 servers that are responsible for caching and authorative answers:
39 3 Nico Schottelius
40
* Authorative
41
** 1x server in place4 (bind)
42
** 1x VRRP IP of routers in place5 (bind)
43
** 1x VRRP IP of routers in place6 (bind)
44
* Caching
45
** 2x server ip of router in place5 (bind)
46
** 2x server ip of router in place6 (bind)
47
48
h2. How to update the ungleich DNS servers
49 1 Nico Schottelius
50 12 Nico Schottelius
To update all servers, use:
51 1 Nico Schottelius
52 3 Nico Schottelius
<pre>
53 24 Nico Schottelius
cdist config d{1..8}.ungleich.ch
54 3 Nico Schottelius
</pre>
55
56 17 Nico Schottelius
|    |                  | "virtual"        | Note       |
57
| d1 | router1.place5   | dns2.ungleich.ch | cache+auth |
58
| d2 | router2.place5   | dns2.ungleich.ch | cache+auth |
59
| d3 | router1.place6   | dns3.ungleich.ch | cache+auth |
60
| d4 | router2.place6   | dns3.ungleich.ch | cache+auth |
61
| d5 | server1.place4   | dns1.ungleich.ch | auth       |
62 1 Nico Schottelius
| d6 | dns6.ungleich.ch | -                | auth+synth |
63 17 Nico Schottelius
| d7 | dns7.ungleich.ch | -                | auth+synth |
64 24 Nico Schottelius
| d8 | router1.place10  | -                | cache+auth |
65 17 Nico Schottelius
66
67 4 Nico Schottelius
h2. How to use the authorative DNS servers in zone files
68 3 Nico Schottelius
69
Add the following to your zone file:
70
71
<pre>
72 5 Nico Schottelius
    ; server1.place4
73
    IN NS dns1.ungleich.ch.
74
75
    ; vrrp active router @ place5
76
    IN NS dns2.ungleich.ch.
77
    
78
    ; vrrp active router @ place6
79
    IN NS dns3.ungleich.ch.
80 18 Timothée Floure
</pre>
81
82
h2. DNS64 at datacenterlight/ipv6onlyhosting
83
84 20 Timothée Floure
"NAT64":https://en.wikipedia.org/wiki/NAT64 allows ipv6-only nodes to reach the v4 world, and requires DNS64 at ungleich.
85 1 Nico Schottelius
86 20 Timothée Floure
h3. DNS64 resolvers
87
88
DNS64 is usually provided by BIND (d{1..7}.ungleich.ch) depending on the address/prefix emitting the request (see `type/__ungleich_dns_server` in dot-cdist). It can also be provided by the unbound servers of place6 (unbound{1,2}.place6.ungleich.ch), which unconditionally serve DNS64.
89
90
h3. Customer VMS
91
92
The production infrastructure for DCL/V6OnlyHosting runs at place6 and networks are assigned as follow:
93
94 18 Timothée Floure
* IPv6Only VMs are assigned to the `place6-ipv6-nat64` OpenNebula network.
95
* Dual-stack VM are assigned to the `place6-ipv4` and `place6-ipv6`
96
97 1 Nico Schottelius
The `place6-ipv6-nat64` networks *provides NAT64* but the `place6-ipv6` *does not*: we do not want ipv4-capable VMs to be NAT'ed behind NAT64. Due to *legacy reasons*, some ipv6only VMs are in `place6-ipv6` but have NAT64 due to hardcoded per-ip configuration our bind DNS server (see `type/__ungleich_dns_server` type in dot-cdist).
98 18 Timothée Floure
99 20 Timothée Floure
h4. place6-ipv6-with-ip-spoofing
100 18 Timothée Floure
101
This OpenNebula network is used to routes v6 prefixes (/64, /56, /48) to customer VMs and is shared by Ipv6-Only and Dual-Stack VMs: NAT64 is *disabled* on this network. IPv6-Only customers on this network *MUST* use unbound1.place6.ungleich.ch and unbound2.place6.ungleich.ch as name server. Their `/etc/resolve.conf` file should look like:
102
103
<pre>
104
nameserver 2a0a:e5c0:2:12:0:f0ff:fea9:c451
105 1 Nico Schottelius
nameserver 2a0a:e5c0:2:12:0:f0ff:fea9:c45d
106
</pre>
107 20 Timothée Floure
108
h3. DNS64 in Ungleich IPv6 VPN
109
110 21 Timothée Floure
Using ungleich's DNS64 resolvers also allows to route all traffic via the ungleich VPN when enabled. You'll find more details on the [[Ungleich IPv6 wireguard VPN]] page.
111
112 19 Timothée Floure
113
h2. Monitoring
114
115
The unbound DNS64 resolvers are monitored by our prometheus blackbox exporter (see `type/__dcl_monitoring_server` in dot-cdist).