5 ms·

I'm looking forward for "old men" to retire. Stuff like systemd (and systemd-resolved) are wonderful innovation and that m god they're the de-facto standard on

by znpy 5y ago

I'm looking forward for "old men" to retire. Stuff like systemd (and systemd-resolved) are wonderful innovation and that m god they're the de-facto standard on most desktops. And by the way, the joy of systemd-resolved is in complex stuff that become surprisingly easy. Example: split-horizon DNS. You're connected to a VPN network but you're only routing some subnets through that, not everything. Thus, you have to have DNS that query some DNS server inside the VPN for a set of domains, but keep using the usual DNS servers for everything else. It's surprisingly easy with systemd-resolved, but I'm not aware of any feasibility without a DNS server running on the local machine (albeit in resolver mode). Which usually would be dnsmasq, but at that point you might as well run systemd-resolved.

iso1631 5y ago
> Example: split-horizon DNS. You're connected to a VPN network but you're only routing some subnets through that, not everything. Thus, you have to have DNS that query some DNS server inside the VPN for a set of domains, but keep using the usual DNS servers for everything else. Why. I want to route 10.0.0.0/8 via a VPN, I don't know if "flargle.bazonga.com" resolves to 10.0.0.1 or 99.99.99.99 until I do the lookup.
- znpy 5y ago
  You might know beforehand. Your employer might have the whole intranet.employer.tld within the VPN. And everything within that network resolves to some 10.8.0.0/8 address.
  - iso1631 5y ago
    I might, but that's not at all how my networks work. Indeed even the corporate business network (which I rarely ever touch) doesn't do that any more - some internal looking DNS resolve to public IPs, some external looking DNS resolve to rfc1918s, some are overwritten if you're on the network or not, and vpns are now based around zscaler which doesn't even allow access via IP address, not entirely sure how it works but DNS resolves everything to 100.64.x.x or similar (cg nat I believe) - not sure how it routes web traffic to the right server, but as I say I very rarely use it (I don't think I've used it since covid started) If I were setting up a corporate laptop, I would likely set all dns, and possibly all traffic, routing via the vpn for security/compliance/monitoring purposes. What benefit does resolvd give me?
- mark-wagner 5y ago
  If bazonga.com is domain only accessible through the VPN then you most likely always want to look up flargle.bazonga.com through the VPN name servers. On the internet you'll get NXDOMAIN. However, this could be solved by setting the name servers always to the VPN name servers and make them recursive. But then, what if those name servers don't have internet access?
gerdesj 5y ago
"I'm looking forward for "old men" to retire." Well I'm a shade over 50. I use Arch on my laptop. I love the flexibility of NetworkManager and I use a variety of DNS sources including a local unbound and a /etc/hosts file. I have a wired ethernet profile called RFC1918 with a lot of addresses on it that covers pretty much all router, firewall and switch defaults. It crucially has the check box for "Use only for connections..." in the routes section. That means that the default gateway stays on the wifi and/or VPN. I have several other profiles to deal with various combinations of requirements. Recently I modelled a data centre on my home network to get a Fortigate cluster up and running as though it was in place. It's WAN was behind a VLAN on my home pfSense, so it had it's "real" external IPs running fine and then I put VMs in at various places to test out routing and policy before deployment. DNS is simply (lol) a name to address mechanism and there is no need to get too het up about it. I simply make whatever view of the world I need to exist at the time I'm doing a job. I do this for IPv4 and 6. It can get a bit challenging WFH. I have a site to site IPSEC VPN to the office and also a OpenVPN dial up VPN connection available. Customer sites are generally setup to allow access from certain IPs and I have to make sure I appear to be the right address. Even more fun is had with the quite large collection of sites with a subnet range of 192.168.{0|1}.0/24. Those I generally wholesale NAT and then for the really dumb devices at the other end or those with a broken routing table, NAT outbound on LAN. "My eyes are bent my back is grey ..." Bloody kids 8)
- iso1631 5y ago
  I use networkmanager on my laptop. 99%+ of my linux machines are not laptops so I don't need network manager on them. I use dnsmasq on two servers, which has a few local dns entries in its host (either to block lookups for some sites like dailymail.co.uk, or to have an entry for "nas" pointing to 192.168.0.51) and upstreams the rest of the queries. I don't need a forwarder on the other machines on the network, they are told by dhcp to use those two servers when they are on my network, when they're on another network dhcp tells them to use something else. I run syslog on a few servers listening to an anycast device, and syslog fires text to the local machine and that anycast IP. Had a problem last night with a systemd-resolvd server, I'd added an entry to DNS, and it wasn't working. Of course that's because the entry hadn't migrated from the main dns server to the backup one (the cronjob runs every 20 minutes as it has done for over a decade), and systemd decided to use the backup server (which is very rarely used). That costs me time. If I want fancy DNS resolving paths, I can choose to install a fancy forwarder. (For WFH I do have a router I can plug my laptop and other devices like a pi into and everything is forwarded through work, including routes to 0.0.0.0/0. No natting involved. When I bring my VPN up on the road, everything is routed via the VPN (other than the vpn end point obviously). I wouldn't bridge my network normally, why would I bridge it with a VPN?)

by znpy 5y ago

iso1631 5y ago

> Example: split-horizon DNS. You're connected to a VPN network but you're only routing some subnets through that, not everything. Thus, you have to have DNS that query some DNS server inside the VPN for a set of domains, but keep using the usual DNS servers for everything else. Why. I want to route 10.0.0.0/8 via a VPN, I don't know if "flargle.bazonga.com" resolves to 10.0.0.1 or 99.99.99.99 until I do the lookup.

znpy 5y ago
You might know beforehand. Your employer might have the whole intranet.employer.tld within the VPN. And everything within that network resolves to some 10.8.0.0/8 address.
- iso1631 5y ago
  I might, but that's not at all how my networks work. Indeed even the corporate business network (which I rarely ever touch) doesn't do that any more - some internal looking DNS resolve to public IPs, some external looking DNS resolve to rfc1918s, some are overwritten if you're on the network or not, and vpns are now based around zscaler which doesn't even allow access via IP address, not entirely sure how it works but DNS resolves everything to 100.64.x.x or similar (cg nat I believe) - not sure how it routes web traffic to the right server, but as I say I very rarely use it (I don't think I've used it since covid started) If I were setting up a corporate laptop, I would likely set all dns, and possibly all traffic, routing via the vpn for security/compliance/monitoring purposes. What benefit does resolvd give me?
mark-wagner 5y ago
If bazonga.com is domain only accessible through the VPN then you most likely always want to look up flargle.bazonga.com through the VPN name servers. On the internet you'll get NXDOMAIN. However, this could be solved by setting the name servers always to the VPN name servers and make them recursive. But then, what if those name servers don't have internet access?

gerdesj 5y ago

"I'm looking forward for "old men" to retire." Well I'm a shade over 50. I use Arch on my laptop. I love the flexibility of NetworkManager and I use a variety of DNS sources including a local unbound and a /etc/hosts file. I have a wired ethernet profile called RFC1918 with a lot of addresses on it that covers pretty much all router, firewall and switch defaults. It crucially has the check box for "Use only for connections..." in the routes section. That means that the default gateway stays on the wifi and/or VPN. I have several other profiles to deal with various combinations of requirements. Recently I modelled a data centre on my home network to get a Fortigate cluster up and running as though it was in place. It's WAN was behind a VLAN on my home pfSense, so it had it's "real" external IPs running fine and then I put VMs in at various places to test out routing and policy before deployment. DNS is simply (lol) a name to address mechanism and there is no need to get too het up about it. I simply make whatever view of the world I need to exist at the time I'm doing a job. I do this for IPv4 and 6. It can get a bit challenging WFH. I have a site to site IPSEC VPN to the office and also a OpenVPN dial up VPN connection available. Customer sites are generally setup to allow access from certain IPs and I have to make sure I appear to be the right address. Even more fun is had with the quite large collection of sites with a subnet range of 192.168.{0|1}.0/24. Those I generally wholesale NAT and then for the really dumb devices at the other end or those with a broken routing table, NAT outbound on LAN. "My eyes are bent my back is grey ..." Bloody kids 8)

iso1631 5y ago
I use networkmanager on my laptop. 99%+ of my linux machines are not laptops so I don't need network manager on them. I use dnsmasq on two servers, which has a few local dns entries in its host (either to block lookups for some sites like dailymail.co.uk, or to have an entry for "nas" pointing to 192.168.0.51) and upstreams the rest of the queries. I don't need a forwarder on the other machines on the network, they are told by dhcp to use those two servers when they are on my network, when they're on another network dhcp tells them to use something else. I run syslog on a few servers listening to an anycast device, and syslog fires text to the local machine and that anycast IP. Had a problem last night with a systemd-resolvd server, I'd added an entry to DNS, and it wasn't working. Of course that's because the entry hadn't migrated from the main dns server to the backup one (the cronjob runs every 20 minutes as it has done for over a decade), and systemd decided to use the backup server (which is very rarely used). That costs me time. If I want fancy DNS resolving paths, I can choose to install a fancy forwarder. (For WFH I do have a router I can plug my laptop and other devices like a pi into and everything is forwarded through work, including routes to 0.0.0.0/0. No natting involved. When I bring my VPN up on the road, everything is routed via the VPN (other than the vpn end point obviously). I wouldn't bridge my network normally, why would I bridge it with a VPN?)