- residential DSL line, using a "plastic router" (CPE, customer premises equipment), in my case, a "FritzBOX" from AVM
- computers I work on (Laptop, Desktop)
- server machines I run services on
The local router provides routing (obviously) and hands out IP addresses via DHCP (V4) and stateless IPv6 autoconfiguration, but it also manages a local DNS server synchronized to the DHCP leases (domain fritz.box.). It also registers its external IP address with a dynamic DNS provider, so that I have an externally visible DNS record point to its IPv4 address. I have a static IPv6 address provided by a tunnel provider.
To my local server machine I can SSH from the outside, using the dynamic IPv4 address updated by the router, but also to the static IPv6 address via my tunnel provider:
- IPv4 from the outside, home.dyn.domain. A = 84.39.93.115 (dynamic)
- IPv6 from the outside, home.dyn.domain. AAAA = 2001:...:fea3 (static)
Problem 1. When on my local LAN, the local server needs to be acessed using its local IPv4 address, or it's global IPv6 address (e.g. 172.17.2.8 (local) and the IPv6 address above 2001:...:fea3 (static)). I can't connect to the local IPv4 address of my server via the dyndns hostname, as I cannot reach 84.29.93.115 from within my LAN, but that's what the SSL certificate is issued to, so I get a warning when using the local IPv4 address.
Problem 2. The DNS resolver of the "Fritz!BOX" unfortunately forwards to a stupid DNS server which cannot resolve via IPv6 DNS servers (it can resolve IPv6 addresses via IPv4 servers, though).
What I want, therefore, is a 2nd IPv6 aware DNS server which fowards the local LAN domain (fritz.box) to the plastic router, resolves IPv6 addresses.
Problem 3. My provider's DNS is a single point of failure, and doesn't even support DNSsec.
Solution: Run my own DNS resolver, but the local LAN (fritz.box) domain is below box., so I have to disable DNSsec for those particular domains.
- correctly forwards local LAN domains ("fritz.box") and reverse DNS to plastic router
- replaces external dynamic DNS IPv4 with local LAN IPv4 address
- acts as a caching resolver, without resorting to broken ISP DNS server
; local resolver
$ host home.dyn.vogel.cx
home.dyn.vogel.cx has address 192.168.178.117
home.dyn.vogel.cx has IPv6 address 2001:XXX...
; google DNS (external)
$ host home.dyn.vogel.cx 8.8.8.8
home.dyn.vogel.cx has address 84.39.93.115
home.dyn.vogel.cx has IPv6 address 2001:XXX...
; local LAN domains
$ host optiplex980.fritz.box
optiplex980.fritz.box has address 172.17.2.8
optiplex980.fritz.box has IPv6 address 2001:XXX...
; local LAN reverse
$ host 172.17.2.8
8.2.17.172.in-addr.arpa domain name pointer optiplex980.fritz.box.
Configuration
/etc/named.conf
logging {
category default { default_syslog; };
category unmatched { null; };
};
key "rndc-key" {
algorithm "hmac-sha256";
secret "XXX";
};
controls {
inet 127.0.0.1 port 953 allow {
127.0.0.1/32;
} keys {
"rndc-key";
};
};
options {
directory "/var/named";
hostname none;
listen-on-v6 { "any"; };
pid-file "/run/named/named.pid";
querylog no;
server-id none;
version none;
allow-recursion {
127.0.0.1/32; /* localhost */
::1/128;
10.0.0.0/8; /* RFC1918 */
172.16.0.0/12;
192.168.0.0/16;
169.254.0.0/16; /* link-local */
fe80::/16;
fd00::/16;
2001:XXX:XXX:XXX::/64; /* local IPv6 Prefix */
};
allow-transfer { none; };
allow-update { none; };
empty-zones-enable no;
stale-answer-enable yes;
/* didn't find this in the manual, but in the changelog
to BIND 9.13.3, this option specifies a list of domains
beneath which DNSSEC validation should not be performed */
validate-except {
"fritz.box";
"fritz.nas";
"wpad.box";
};
};
zone "localhost" IN {
type master;
file "localhost.zone";
};
zone "0.0.127.in-addr.arpa" IN {
type master;
file "127.0.0.zone";
};
zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" {
type master;
file "localhost.ip6.zone";
};
zone "255.in-addr.arpa" IN {
type master;
file "empty.zone";
};
zone "0.in-addr.arpa" IN {
type master;
file "empty.zone";
};
zone "." IN {
type hint;
file "root.hint";
};
# --- resolve our "dynamic DNS" correctly to the internal ---
# --- ip addresses (which are obviously not dynamic) ---
zone "dyn.XXX.XXX" IN {
type master;
file "dyn.XXX.XXX.zone";
};
# --- local plastic "router" is managing these zones ---
# fritz.box
zone "fritz.box" IN {
type forward;
forward only ;
forwarders { 172.17.2.1; };
};
zone "wpad.box" IN {
type forward;
forward only ;
forwarders { 172.17.2.1; };
};
zone "fritz.nas" IN {
type forward;
forward only ;
forwarders { 172.17.2.1; };
};
# 172.17.2/24
zone "2.17.172.in-addr.arpa" IN {
type forward;
forward only ;
forwarders { 172.17.2.1; };
};
# 2001:XXXXX::/64
zone "X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.ip6.arpa" IN {
type forward;
forward only ;
forwarders { 172.17.2.1; };
};
# fd00::/64
zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.d.f.ip6.arpa" IN {
type forward;
forward only ;
forwarders { 172.17.2.1; };
};
/var/named/dyn.XXX.XXX.zone
@ 86400 IN SOA home hostmaster (
2018110401 ;serial
10800 ;refresh
1800 ;retry
604800 ;expire
86400 ;minimum
)
@ IN NS home
@ IN MX 10 home
; local addresses of my home server
home IN A 192.168.178.117
home IN AAAA 2001:XXX:XXX:XXX:XXX:XXX:XXX:XXX
