3 ms·

How do you run a DNS server when your address isn't technically static? How do clients discover the DNS server in a SLAAC environment?

• wmf 2y ago
  How do you run a DNS server when your address isn't technically static? For Internet-facing DNS you don't. For your internal resolver you could create a static address within a ULA (e.g. $PREFIX::1). How do clients discover the DNS server in a SLAAC environment? https://www.rfc-editor.org/rfc/rfc8106.html https://www.rfc-editor.org/rfc/rfc8106.html
• hairyplanter 2y ago
  RA message can specify a DNS server. Mine specifies the router's ULA, which is effectively static, and it runs unbounded.
  • mannyv 2y ago
    How do you authenticate RA messages? I mean, can anyone just throw RA messages onto the network? This seems like the "rogue DHCP" problem in v4.
    • winthrowe 2y ago
      Similar to v4 DHCP guard, configure RA guard on your switches.
• anthropodie 2y ago
  Someone correct me if I'm wrong Your link local or ULA is static address and can be used for DNS. DNS server is advertised when prefix is advertised.
• labcomputer 2y ago
  1. You create a ULA prefix (fc00:/7) on your local network. See https://en.m.wikipedia.org/wiki/Unique_local_address https://en.m.wikipedia.org/wiki/Unique_local_address 2. Then you have your router advertise that prefix. 3. Then you have your DNS server pick a non-temporary address within that prefix (either manually set it, or let the OS pick one). 4. Then you tell your router to advertise that address as the DNS server in the RA. Depending on how you have your network set up, your DNS server will have probably four IPv6 addresses: A link-local one; one on the ULA prefix you created; a non-temporary address on the prefix delegated by your ISP; and one or more temporary addresses on the prefix delegated by your ISP. Outgoing connections (for recursive resolving) will be on one of the temporary addresses from the PD prefix. The DNS server listens on the static ULA address. You need to configure your firewall such that traffic from the delegated prefix can get to the ULA one, and vice versa. This usually just means blocking traffic from the WAN port to the ULA prefix.
  • anthropodie 2y ago
    If your router does not support ULA configuration like in my case you can make a device like raspberry pi to advertise ULA. You can refer this thread for that configuration https://www.reddit.com/r/ipv6/comments/1af0r2v/using_rpi_to_advertise_ula_how_to_make_it_work/ https://www.reddit.com/r/ipv6/comments/1af0r2v/using_rpi_to_...
• riedel 2y ago
  I also couldn't figure out to how to get that working. It's seems you need both DNS via RA (RFC6106) and (stateless) DHCPv6. Then there was a bug in CoreDNS that wouldn't bind link local. What I learned from the text is that I should have probably generated a unique address for the DNS. It is not only confusing theoretically but also the ISP router config makes it even more confusing.
• mannyv 2y ago
  How do you enter your other hosts into DNS? Just give them ULAs as well? Or is there a dynamic DNS hostname ipv6 mechanism?