DNS分離解析IPV6與IPV4用戶

IPV6改造中經常會遇到,網站使用了CDN,但是CDN廠商還不支持IPV6的情況,而AAAA、A、CNAME記錄互相沖突,想實現IPV6用戶得到AAAA記錄,IPV4用戶得到CNAME記錄的需求。

解決方式是在域名權威服務器上根據源IP地址匹配不同的解析數據庫。 但是問題的處理並不是那麼簡單,這種方式在內部DNS使用倒是沒有問題,如果在全國互聯網中使用會有問題,根據源地址指定不同的ZONE,按照DNS查詢的步驟,源地址代表的是用戶當地的遞歸查詢服務器的互聯網出口,並不是IPV6用戶本身,所以要確保本地遞歸查詢服務器擁有IPV6互聯網出口。該方式也經常會用在多線路智能解析上。

但是如果用戶側是純IPV4的網絡,遞歸查詢DNS是IPV6/IPV4雙棧網絡,那就會導致IPV4用戶拿不到A記錄。或者如果遞歸DNS是IPV4網絡,而用戶側是IPV6網絡,那IPV6用戶也拿不到AAAA的記錄。所以互聯網中使用這種方案會存在問題。

權威服務器的配置,以BIND爲例。

view "ipv4" {
    match-clients { 0.0.0.0/0; };
    zone "vpandacloud.org" IN {
            type master;
            file "vpandacloud.org.zone";
    };
    zone "." IN {
        type hint;
        file "named.ca";
    };
    include "/etc/named.rfc1912.zones";
    include "/etc/named.root.key";
    };

view "ipv6" {
        match-clients { ::/0; };
        zone "vpandacloud.org" IN {
                type master;
                file "vpandacloud.org.ipv6.zone";
        };
        zone "." IN {
        type hint;
        file "named.ca";
        };
        include "/etc/named.rfc1912.zones";
        include "/etc/named.root.key";
        };

解析數據庫配置:

-rw-r-----. 1 root  named  644 1月  15 11:00 vpandacloud.org.ipv6.zone
-rw-r-----. 1 root  named  591 1月  15 10:49 vpandacloud.org.zone
[[email protected] named]# cat vpandacloud.org.ipv6.zone
$TTL 6h
vpandacloud.org.              IN  SOA dnsserver.vpandacloud.org.  dnsserver2.vpandacloud.org (
                       1     ; serial num
                       3h    ; refresh time 
                       1h    ; retry time 
                       1w    ; expire time
                       1h )  ; negative time

vpandacloud.org.              IN  NS  dnsserver.vpandacloud.org.

dnsserver.vpandacloud.org.    IN  A   10.0.0.11

ipv4.vpandacloud.org.          IN  A   1.1.1.1
cdn.vpandacloud.org.          IN  A   2.2.2.2


www.vpandacloud.org.    IN A 3.3.3.3
www.vpandacloud.org.         IN  AAAA  fd15:4ba5:5a2b:100b:250:56ff:fe3d:aa3c
===========================================================
[[email protected] named]# cat vpandacloud.org.zone
$TTL 6h
vpandacloud.org.              IN  SOA dnsserver.vpandacloud.org.  dnsserver2.vpandacloud.org (
                       1     ; serial num
                       3h    ; refresh time 
                       1h    ; retry time 
                       1w    ; expire time
                       1h )  ; negative time

vpandacloud.org.              IN  NS  dnsserver.vpandacloud.org.

dnsserver.vpandacloud.org.    IN  A   10.0.0.11
ipv4.vpandacloud.org.          IN  A   8.8.8.8
cdn.vpandacloud.org.          IN  A   2.2.2.2

www.vpandacloud.org.         IN  CNAME  cdn.vpandacloud.org.
[[email protected] named]#

效果驗證

發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章