11 ms·
Xip.io: Wildcard DNS for Everyone
- mike_d 7y agoJust a heads up that services like these won't work behind security-aware DNS recursive resolvers (like OpenDNS) or routers (like Google Wifi) that block DNS rebinding attacks. https://en.wikipedia.org/wiki/DNS_rebinding https://en.wikipedia.org/wiki/DNS_rebinding https://support.google.com/wifi/answer/9144137?hl=en https://support.google.com/wifi/answer/9144137?hl=en
- ploxiln 7y agoAre you sure? I think these dns names are deterministic, they never change, for example www.10.0.0.1.xip.io will always resolve to 10.0.0.1 - and I don't think there is a mode where a name could resolve to different ipv4 addresses at different times. EDIT: I experimentally confirmed that opendns and google dns, which claim to block dns rebinding attacks, do not block xip.io or subdomains thereof
- deleted 7y ago[deleted]
- phlo 7y agoIt depends on the implementation of the DNS rebinding protection. I have just checked, and my pfSense firewall (which claims to block DNS rebinding) blocks local addresses from resolving through xip.io (tested with loopback and several RFC1918. All blocked, regardless of whether they match the subnet in use). External addresses (e.g. 1.1.1.1.xip.io) resolve fine.
- bscphil 7y agoI see this too, with Unbound. Using Cloudflare over TLS as my upstream resolver.
- garymoon 7y agoIt was the first thing that came to my mind when I read about xip.io!
- jchw 7y agoIt should work for external IP addresses regardless.
- icholy 7y agoWhat's the advantage over just typing the IP into the browser bar?
- sleepybrett 7y agoI know my corporate firewalls do not allow connections to bare ip addresses. This allows me to bypass that check for things I haven't assigned names to already.
- yathna 7y agothis makes no sense -- all tcp connections are already to the "bare ip address". dns lookup happens independently of the ip connection. in the case of a browser, your browser asks the local resolver (or with doh, remote nameserver) what the ip is for a given domain, then connects to that ip. I suppose it's possible your network has some strange setup that pokes holes through the firewall based on dns requests, but that would be obscenely expensive both computationally and financially.
- clwg 7y agoThe simplest implementation of this would be to block all outbound traffic for all hosts by default, and allow only web traffic out through a proxy. Then for other specific services poke holes for specific src<->dst.
- icedchai 7y agoHe probably means his corporate proxy servers, not firewalls.
- sleepybrett 7y agoindeed, sorry.
- clinta 7y agoThe firewall or proxy is probably looking at the HTTP host header, and blocking requests with an IP there.
- deleted 7y ago[deleted]
- ezekg 7y agoI used this and lvh.me a lot in the past to share WIP work or test webhooks but nowadays that has all since been replaced by ngrok.
- iwalton3 7y agoInterestingly enough, Plex is running something very similar to this to support SSL for all of their users. a-b-c-d.guid.plex.direct will resolve to a.b.c.d. (Where guid is replaced with a guid, without dashes.)
- yegle 7y agohttps://blog.filippo.io/how-plex-is-doing-https-for-all-its-users/ https://blog.filippo.io/how-plex-is-doing-https-for-all-its-...
- johnchristopher 7y agoOh, I remember that one ! Personally I just set up (dev machine is always running some Debian or derivatives) Traefik as a reverse proxy and set up local dev websites/app with *.localhost. I don't bother adding localhost self-signed certs to FF though (never really could make it work anyway). Easier to click "yes, trust that certificate for that localhost subdomain).
- jdofaz 7y agohttps://nip.io https://nip.io is another option
- chaz6 7y agoNice idea, shame it does not work with IPv6. dig 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.xip.io. in aaaa ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
- loganv 7y agoI've been running a similar service for the past few years on continuous.pw, which supports both ipv4 and ipv6. Examples: 7f000001.ip.continuous.pw has address 127.0.0.1 fc00.ip6.continuous.pw has IPv6 address fc00:: fc0014c0000001abcde.ip6.continuous.pw has IPv6 address fc00:14c0:0:1ab:cde0:: Sources available at https://github.com/continuouspw/continuous-dns/tree/master/playbooks/files https://github.com/continuouspw/continuous-dns/tree/master/p...
- mises 7y agoQuick PSA: You can do this yourself on cloudflare. I've got a sub-domain of my web site, "localhost.my.site". That resolves to localhost. I also added a wildcard, "*.localhost.my.site", which also resolves to localhost. It's pretty easy to do, and a handy trick. I figure some one probably turned this into a blog post, but this way you don't have to rely on some one else's stuff going down. I also use it for my local domain, cause I don't want to bother running a local DNS server.
- sleepybrett 7y agothat only resolves to localhost though.. Also allows you to set up vhosts if your quickie server is stood up behind something like nginx.
- deleted 7y ago[deleted]
- tacticaldev 7y agoanyone else get a HTTP 105 while trying to access xip.io ? (ERR_NAME_NOT_RESOLVED)
- cwt137 7y agoyes
- Batman8675309 7y agoSame here bro.
- ndidi 7y agoThat's not an HTTP error code.
- dragonwriter 7y agoError 105 is an internal Chrome DNS-related error code, not an HTTP code. HTTP 1xx codes are informational, not error, codes, and 105 doesn't exist.
- kenforthewin 7y agoCool idea. I use dnsmasq locally but seems like this would work well too.
- koolba 7y agoIs this still written in Bash?
- mike_d 7y agoYes, fronted by PowerDNS. https://github.com/basecamp/xip-pdns/blob/master/bin/xip-pdns https://github.com/basecamp/xip-pdns/blob/master/bin/xip-pdn...
- SkyLinx 7y agoThis service is super useful, I use it to test the custom domains feature in my app.
- ohnoesjmr 7y agoNext up, TLS certs for the random hostnames? Are there security implications to this?
- InTheArena 7y agoWe've used this before, and it seems to be catastrophically unreliable.We had development projects on a internal development reverse proxy that we wanted to specify with a name, and found that it quite often broke down. It could be their DNS relay, or some other network event, but at least once a week, it would simply timeout. I would kill to be able to specify wildcards in /etc/hosts file. That seems to be the sweet-spot.
- jbverschoor 7y agoStill not sure why that is not available
- jiveturkey 7y agoThis is so absolutely trivial to implement, why would anyone use their service in the first place?
- djsumdog 7y agoI agree. If you're using it for development within your company, you should just configure your own. There are a number of open source DNS resolvers (some mentioned in these comments) that can be configured to do this.
- cat199 7y agoomg like wow sooooooo much infrastructure i cant even lol kthx really? it's called sarcasm people.
- deleted 7y ago[deleted]
- inglor 7y agoWe ended up using ngrok for our development builds and while it's certainly a lot more setup (and it costs us money) I am pretty happy with the results and as a customer for that use case. We sell a SaaS e2e testing product for large enterprises (clients like Microsoft/Wix/JPM etc) and this use case (serving the dev environment to the CI or between computers) was so common that we baked it into our CLI.
- linuxdude314 7y agoUnlike ngrok his doesn't "expose" anything. Its just a lazy way to add DNS to a test environment. If you already have a cloud provider, why would you leverage this instead of just creating real DNS records w/ reasonable TTLs?
- 3xblah 7y ago"How does it work? xip.io runs a custom DNS server on the public Internet." Is there a way to provide wildcard DNS without sending internal LAN IP addresses to a closed source "custom DNS server" over the public Internet? Yes. If you are a djbdns^1 user, and you wanted all subdomains of xip.io to resolve to 10.0.0.1: # Assuming _dnscache and _tinydns are the configuration folders and tinydns listens on 127.0.0.1 cat << eof > _tinydns/root/data .xip.io. &*.xip.io:127.0.0.1 =*.xip.io.:10.0.0.1 eof cd _tinydns/root make cd - echo 127.0.0.1 > _dnscache/root/servers/xip.io If you are an unbound user, you can put dnscache in front of unbound: # Assuming unbound listens on 10.0.0.2 echo > _dnscache/env/FORWARDONLY echo 10.0.0.2 > _dnscache/root/servers/@ 1 http://cr.yp.to/djbdns.html http://cr.yp.to/djbdns.html
- yy77 7y agowhy will we need such service? If we have to include the detailed IP address in the URL, why not direct access use IP address itself?