DNS分离解析IPV6与IPV4用户
IPV6改造中经常会遇到,网站使用了CDN,但是CDN厂商还不支持IPV6的情况,而AAAA、A、CNAME记录互相冲突,想实现IPV6用户得到AAAA记录,IPV4用户得到CNAME记录的需求。
解决方式是在域名权威服务器上根据源IP地址匹配不同的解析数据库。 但是问题的处理并不是那么简单,这种方式在内部DNS使用倒是没有问题,如果在全国互联网中使用会有问题,根据源地址指定不同的ZONE,按照DNS查询的步骤,源地址代表的是用户当地的递归查询服务器的互联网出口,并不是IPV6用户本身,所以要确保本地递归查询服务器拥有IPV6互联网出口。该方式也经常会用在多线路智能解析上。
但是如果用户侧是纯IPV4的网络,递归查询DNS是IPV6/IPV4双栈网络,那就会导致IPV4用户拿不到A记录。或者如果递归DNS是IPV4网络,而用户侧是IPV6网络,那IPV6用户也拿不到AAAA的记录。所以互联网中使用这种方案会存在问题。
权威服务器的配置,以BIND为例。
view "ipv4" { match-clients { 0.0.0.0/0; }; zone "vpandacloud.org" IN { type master; file "vpandacloud.org.zone"; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; }; view "ipv6" { match-clients { ::/0; }; zone "vpandacloud.org" IN { type master; file "vpandacloud.org.ipv6.zone"; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; };
解析数据库配置:
-rw-r-----. 1 root named 644 1月 15 11:00 vpandacloud.org.ipv6.zone -rw-r-----. 1 root named 591 1月 15 10:49 vpandacloud.org.zone [root@controller01 named]# cat vpandacloud.org.ipv6.zone $TTL 6h vpandacloud.org. IN SOA dnsserver.vpandacloud.org. dnsserver2.vpandacloud.org ( 1 ; serial num 3h ; refresh time 1h ; retry time 1w ; expire time 1h ) ; negative time vpandacloud.org. IN NS dnsserver.vpandacloud.org. dnsserver.vpandacloud.org. IN A 10.0.0.11 ipv4.vpandacloud.org. IN A 1.1.1.1 cdn.vpandacloud.org. IN A 2.2.2.2 www.vpandacloud.org. IN A 3.3.3.3 www.vpandacloud.org. IN AAAA fd15:4ba5:5a2b:100b:250:56ff:fe3d:aa3c =========================================================== [root@controller01 named]# cat vpandacloud.org.zone $TTL 6h vpandacloud.org. IN SOA dnsserver.vpandacloud.org. dnsserver2.vpandacloud.org ( 1 ; serial num 3h ; refresh time 1h ; retry time 1w ; expire time 1h ) ; negative time vpandacloud.org. IN NS dnsserver.vpandacloud.org. dnsserver.vpandacloud.org. IN A 10.0.0.11 ipv4.vpandacloud.org. IN A 8.8.8.8 cdn.vpandacloud.org. IN A 2.2.2.2 www.vpandacloud.org. IN CNAME cdn.vpandacloud.org. [root@controller01 named]#
效果验证