Difference between revisions of "ChaosVPN:DNS"

From CCCHHWiki
Jump to: navigation, search
(HowTo)
(Moved the more common resolver programs to the top)
Line 18: Line 18:
 
These are configuration example for multiple nameserver programs - choose the config for the one you are running.
 
These are configuration example for multiple nameserver programs - choose the config for the one you are running.
  
== NSD + unbound ==
+
== dnsmasq ==
  
'''unbound''' and '''NSD''' were developed by [http://www.nlnetlabs.nl/ NLnet Labs] with focus on small footprints and reliability. While '''NSD''' is a complete name server software for authoritative zones only, they also provide '''unbound''' as caching and recursive resolver.  
+
Add to /etc/dnsmasq.conf:
  
=== nsd ===
+
server=/hack/172.31.0.5
In /etc/nsd/nsd3.conf add at bottom:
+
server=/31.172.in-addr.arpa/172.31.0.5
 
+
server=/100.10.in-addr.arpa/172.31.0.5
  zone:
+
server=/101.10.in-addr.arpa/172.31.0.5
        name: "hack"
+
server=/102.10.in-addr.arpa/172.31.0.5
        zonefile: "hack.zone"
+
server=/103.10.in-addr.arpa/172.31.0.5
        allow-notify: 127.0.0.1 NOKEY
 
        allow-notify: 172.31.0.5 NOKEY
 
        request-xfr: 172.31.0.5 NOKEY
 
 
 
 
 
 
 
 
 
=== unbound ===
 
 
 
In /etc/unbound/unbound.conf add at bottom:
 
 
 
  forward-zone:
 
  name: "hack"
 
  forward-addr: 172.31.0.5
 
  forward-addr: 172.31.116.1
 
  forward-zone:
 
  name: "dn42"
 
  forward-addr: 172.22.228.85
 
  forward-addr: 172.22.222.6
 
  
  
Line 102: Line 83:
 
     forwarders { 172.31.0.5; };
 
     forwarders { 172.31.0.5; };
 
   };
 
   };
 +
 +
 +
 +
== NSD + unbound ==
 +
 +
'''unbound''' and '''NSD''' were developed by [http://www.nlnetlabs.nl/ NLnet Labs] with focus on small footprints and reliability. While '''NSD''' is a complete name server software for authoritative zones only, they also provide '''unbound''' as caching and recursive resolver.
 +
 +
=== nsd ===
 +
In /etc/nsd/nsd3.conf add at bottom:
 +
 +
  zone:
 +
        name: "hack"
 +
        zonefile: "hack.zone"
 +
        allow-notify: 127.0.0.1 NOKEY
 +
        allow-notify: 172.31.0.5 NOKEY
 +
        request-xfr: 172.31.0.5 NOKEY
 +
 +
 +
 +
 +
=== unbound ===
 +
 +
In /etc/unbound/unbound.conf add at bottom:
 +
 +
  forward-zone:
 +
  name: "hack"
 +
  forward-addr: 172.31.0.5
 +
  forward-addr: 172.31.116.1
 +
  forward-zone:
 +
  name: "dn42"
 +
  forward-addr: 172.22.228.85
 +
  forward-addr: 172.22.222.6
 +
  
 
== maradns ==
 
== maradns ==
Line 110: Line 124:
  
 
Where '''mycoolnode.hack''' is the domain name, '''212.12.52.216''' is the primary name server and '''db.domain.hack''' is the filename of the zonefile.
 
Where '''mycoolnode.hack''' is the domain name, '''212.12.52.216''' is the primary name server and '''db.domain.hack''' is the filename of the zonefile.
 
== dnsmasq ==
 
 
Add to /etc/dnsmasq.conf:
 
 
server=/hack/172.31.0.5
 
server=/31.172.in-addr.arpa/172.31.0.5
 
server=/100.10.in-addr.arpa/172.31.0.5
 
server=/101.10.in-addr.arpa/172.31.0.5
 
server=/102.10.in-addr.arpa/172.31.0.5
 
server=/103.10.in-addr.arpa/172.31.0.5
 
 
  
  
 
[[Category:ChaosVPN]]
 
[[Category:ChaosVPN]]

Revision as of 23:38, 24 January 2014

We have a DNS running.

how to get entries

Email chaosvpn-join@hamburg.ccc.de to get an entry under .hack or to get a reverse-lookup for your IP / range registered.

configs

The main zonefile atm is edited with vim on cvpn-dns.

This server is available at 172.31.0.5.

You can either be secondary and transfer the zonefile, or query this server.


HowTo

These are configuration example for multiple nameserver programs - choose the config for the one you are running.

dnsmasq

Add to /etc/dnsmasq.conf:

server=/hack/172.31.0.5
server=/31.172.in-addr.arpa/172.31.0.5
server=/100.10.in-addr.arpa/172.31.0.5
server=/101.10.in-addr.arpa/172.31.0.5
server=/102.10.in-addr.arpa/172.31.0.5
server=/103.10.in-addr.arpa/172.31.0.5


bind9

Should-Do´s:

in /etc/bind/named.conf (or for Debian in /etc/bind/named.conf.local):

NOTE: bind9 in debian now attempts to use DNSSEC, which you need to disable in /etc/bind/named.conf.options. Change 'dnssec-validation auto;' to 'dnssec-validation no;' and the static-stub defs should work.

Bind 9.8+ using static-stub (preferred method, Debian Wheezy or newer)

zone "hack" {
  type static-stub;      
  server-addresses { 172.31.0.5; };      
};
zone "dn42" {
  type static-stub;
  server-addresses { 172.22.228.2; 172.22.136.243; 172.22.131.88; 172.22.53.51; };
};
zone "31.172.in-addr.arpa" {
  type static-stub;      
  server-addresses { 172.31.0.5; };
};
zone "100.10.in-addr.arpa" {
  type static-stub;      
  server-addresses { 172.31.0.5; };
};
zone "101.10.in-addr.arpa" {
  type static-stub;      
  server-addresses { 172.31.0.5; };
};
zone "102.10.in-addr.arpa" {
  type static-stub;      
  server-addresses { 172.31.0.5; };
};
zone "103.10.in-addr.arpa" {
  type static-stub;      
  server-addresses { 172.31.0.5; };
};

Bind as secondary

 zone "hack" {
   type slave;
   file "slave/slave.hack";
   masters { 172.31.0.5; };
 };

Old Bind as Forwarder

 zone "hack" {
   type forward;
   forwarders { 172.31.0.5; };
 };


NSD + unbound

unbound and NSD were developed by NLnet Labs with focus on small footprints and reliability. While NSD is a complete name server software for authoritative zones only, they also provide unbound as caching and recursive resolver.

nsd

In /etc/nsd/nsd3.conf add at bottom:

 zone:
       name: "hack"
       zonefile: "hack.zone"
       allow-notify: 127.0.0.1 NOKEY
       allow-notify: 172.31.0.5 NOKEY
       request-xfr: 172.31.0.5 NOKEY



unbound

In /etc/unbound/unbound.conf add at bottom:

 forward-zone:
 	name: "hack"
 	forward-addr: 172.31.0.5
 	forward-addr: 172.31.116.1
 forward-zone:
 	name: "dn42"
 	forward-addr: 172.22.228.85
 	forward-addr: 172.22.222.6


maradns

maradns as secondary

 getzone mycoolnode.hack 212.12.52.216 > /etc/maradns/db.domain.hack

Where mycoolnode.hack is the domain name, 212.12.52.216 is the primary name server and db.domain.hack is the filename of the zonefile.