10 ms·
Xip.io - a magic domain name that provides wildcard DNS for any IP address
- ChuckMcM 14y agoNice hack. Of course reverse dns doesn't work :-) I suppose it kinda sorta could if you tracked where a request came from and what IP you sent it and if you got a reverse lookup you could undo that, but still it is clever!
- devicenull 14y agoReverse DNS is controlled by the company that owns the actual IP address. There's no way for a random website to change responses for it (unless they own the IP range, or were delegated control)
- ChuckMcM 14y agoSort of. Which is to say it is when you don't lie, but you can lie if you know what you want. When you reverse map an IP you look up b4.b3.b2.b1.in-addr.arpa. where b1 - b4 are bytes 1 through 4 (in reverse order) of the IP address. So 10.1.2.3 becomes 3.2.1.10.in-addr.arpa. The interesting bit is you send this to some dns resolver, typically in the 'generic' world your machine got the address of a resolver (and maybe a backup) from the DHCP server that gave it the IP address. When that dns server sees this request what it is supposed to do is to either tell you to 'go fish' and here is the IP of a server than can help, or 'recursively resolve' by forwarding on your request. Now if you run a vanilla BIND or djbdns setup you will get short circuited by it recognizing a 'private' address and not resolving it, if it did try the root servers tell you to go away as well. But if you recognized it as a private address and sent it back to xip.io DNS servers on a lark, they could "pretend" to be authorative for the domain and return you a cname record that pointed back to your fake name. I admit it is a hack on top of another hack but as long as we're writing custom DNS servers why not go all in? :-)
- xxyyxyxyy 14y agoIsn't it controlled by whoever is running the .arpa domain?
- ChuckMcM 14y agoYes and no. There is nothing [1] preventing any DNS server from responding authoritatively to a request that it is presented with, except a moral correctness to the protocol. [1] If you ever wondered how openDNS or your ISP sends you spammy web pages when you try to resolve something that doesn't exist, or how the hotel hijacks your browser into giving you a login page, this is it. You look for google.com it notes you haven't logged in and returns the address for its paywall as the answer. Oh except if you are running dnssec in which case it is a lot harder to lie about what you are authoritative for. But on my dns servers at home they all think they are authoritative for 10.in-addr.arpa. so that they will answer queries for that network.
- xxyyxyxyy 14y agoIs this to say what matters in terms of the response you get is which DNS server you query? And consequently whoever controls that server? You run your own .arpa zone for 10. So you control the PTR responses for 10.0.0.1 that are directed to your home DNS server? Isn't it true that anyone can download a copy of .arpa zone for the public address space? You could load this into your .arpa zone on your home DNS server. Couldn't you shave off a few queries out to the internet for each PTR lookup that way? Running a home DNS server sounds like a smart idea. You say "nothing is to stop...", and due to the "rules" allowing out-of-bailiwick delegations that's true (and also a source of some annoying side effects: cache poisoning, extra queries if glue is ignored, etc.), but what if you designed a DNS server to only query authoritative servers? Then getting the right response would become just a matter of selecting the proper authoritative server from a list, verifying you are actually connecting to that server and then securing the connection from tampering, right? DNSSEC wouldn't address those needs, would it? Anyway, running your own DNS server sounds like a smart idea. No spammy web pages like OpenDNS? Do you connect to your home DNS server while you're staying at hotels to avoid paywalls? If these devices were not crippled maybe you could travel with a good /etc/hosts file with all your important websites listed.
- mparlane 14y agoI hope people trust 37signals.
- ldng 14y agoWell, if you don't : https://github.com/sstephenson/xipd https://github.com/sstephenson/xipd
- zaptheimpaler 14y agoWe have no proof that the code on the repo is related in any way to the code the actual site is running.
- sstephenson 14y agoYou're right. I'm probably just running xip.io to steal all your sensitive development-mode form data!
- mparlane 14y agoInformation you have access to: External ip addresses of requestees. Internal ip addresses of requestees. To some, this is very useful...
- bonzoesc 14y agoCan you be specific instead of "to some?"
- zaptheimpaler 14y agoAha! Give me back my "foo:bar"s!
- mariocesar 14y agoIf you click on the "custom DNS server" link on the site, you will get a surprise
- StavrosK 14y agoHmm... Why wouldn't I just type the IP in?
- eli 14y agoBecause then you can only serve one site from that address. With this you could serve as many different sites as you want based on the first part of the domain name.
- StavrosK 14y agoAh, for virtual hosts, got it. Thanks.
- julian37 14y agoTo expand on this, this problem can usually be solved by editing /etc/hosts. But you can't do that on some platforms such as iOS. By the way, a neat trick is to assign an alias to your network interface in order to avoid the trouble of DHCP giving you a different IP address each time you connect. For example, on Mac OS X: $ sudo ifconfig en1 alias 10.99.99.99 netmask 255.0.0.0 This address will only be reachable from hosts that have a route to it, which can be achieved for example by also giving them an alias on the same subnet. Still, comes in handy at times. (Obviously you want to be sure you're using a vacant address.) (And of course, when you have control over the DHCP server there are more elegant ways of achieving this, such as binding your MAC to a static IP address.) Edited for clarity.
- drivebyacct2 14y agoWhat is the difference between an alias and a static IP address? Also don't most routers attempt to give IPs back to the MAC that last had them?
- julian37 14y agoWhat is the difference between an alias and a static IP address? Not sure what you mean. If you're referring to the bit about binding MAC to an address, I should probably have said "fixed IP" rather than "static IP", sorry about that. Also don't most routers attempt to give IPs back to the MAC that last had them? I'm hopping between different networks (with different DHCP servers) quite a lot, maybe it's less useful when you're always on the same network.
- deleted 14y ago[deleted]
- iapi 14y agolooks very useful
- beagle3 14y agoWhat is the use case that requires http://test.10.0.0.3.xip.io/test-page http://test.10.0.0.3.xip.io/test-page rather than http://10.0.0.3/test-page http://10.0.0.3/test-page ? I've been using the latter on iphones and ipads with no problem. Honest question.
- defer 14y agoThis would support multiple vhosts.
- beggi 14y agoYou can't test multiple sites on the same host using just the IP.
- noselasd 14y agoWhich is when you add them to /etc/hosts
- beggi 14y agoCan't do that on an iPhone or iPad
- vasco 14y ago"You can't test multiple sites on the same host using just the IP." I'm not getting what the problem is. Isn't this what ports are for? Or even just running the websites on different folders?
- jarin 14y agoThis is the best way to get a "natural" development environment (i.e. as close to production as possible). Also, it's a pain in the ass having to start and stop various apps and remember ports, which is what Pow is great for in the first place.
- bonzoesc 14y agoPorts are a pain in the ass compared to persistent names.
- sstephenson 14y agoFor those who missed the other announcement, Pow 0.4.0 has xip.io support built-in: http://37signals.com/svn/posts/3191-announcing-pow-040-with-xipio-support http://37signals.com/svn/posts/3191-announcing-pow-040-with-...
- MartinMond 14y agoDoes that actually work? On my machine pow has ipfw configured so that it only forwards requests to 127.0.0.1 not to 10.0.1.whatever so project.10.0.0.5.xip.io fails. Filed an issue: https://github.com/37signals/pow/issues/293 https://github.com/37signals/pow/issues/293 Edit: a) I should RTF man page for ipfw, b) nevertheless my OS X behaved strangely. I rebooted and now everything works. Anyway, great project, have been a happy user of pow master for quite a while.
- aaroneous 14y agoI wish one of the localhost-to-web projects like showoff.io or localtunnel would allow wildcard hostnames like this.
- nvoorhies 14y agoI think it really speaks to the impoverished startup environment in Chicago that this ends up as an un-monetized throwaway product. In Silicon Valley an idea like this could lead to a helluva exit with backing from incubators like YC.
- impoverished 14y agoThat's funny. I would interpet it the other way around. It doesn't say much for SV if they have to make money off of redundant little .js hacks like this. They have nothing better? That's the problem with SV. Lots of stupid money, conniving VC and no standard for what constitutes an actual business. They can take anything and spin it into a "company" just to reach a "helluva exit". What a joke. It is all going to implode.
- atomaka 14y agoWhy is this better than adding an entry to my hosts file?
- sstephenson 14y agoHow are you going to add an entry to the hosts file on an iPhone?
- deleted 14y ago[deleted]
- MiguelHudnandez 14y agoI know you meant your question rhetorically, but I believe you can add a proxy server to the iPhone and handle any hostname trickery there. Edit: Proxy settings can't be global, but are assigned individually for each WiFi connection.
- Karunamon 14y agoYeah but then you're into jailbreak-warranty-invalidation territory. Great for personal devices, not so great on corporate.
- sstephenson 14y agoOr you can use xip.io and save yourself a lot of trouble.
- xxyyxyxyy 14y agoThis is a hack for devices where the user cannot access /etc/hosts? Running a local DNS server on these devices is also not possible? Can a user access ifconfig and change interface settings, e.g. adding an alias? In terms of networking, these devices appear to be crippled. Yet they do not have to be if they're built using code from BSD's.
- BoldAsAnEagle 14y agoIt is a sad day when "solutions" like these xip.io is necessary for something that our general computing devices are already equiped with and capable of since the 80ies.
- jsprinkles 14y agoI've identified several technical problems with this domain, and this isn't an example of how to properly operate DNS. 37signals is setting an absurdly low TTL on these records (10 minutes; the answers never change, I absolutely do not understand the logic behind this TTL), which means every 10 minutes you're re-resolving a local address, through a CNAME (so two DNS round trips, and in my case this resolution took between 115ms and 230ms, not small change): [~]$ dig foo.169.254.84.1.xip.io foo.169.254.84.1.xip.io. 600 IN CNAME foo.daze1.xip.io. foo.daze1.xip.io. 600 IN A 169.254.84.1 Concerningly, ns-1.xip.io is also broken; it does not serve NS records for its own zone, instead relying upon the SOA record and the upstream glue, which I'm shocked works: [~]$ dig +short NS xip.io [~]$ The nameserver delegation from nic.io is also broken: xip.io. 86400 IN NS ns-1.xip.io. xip.io. 86400 IN NS ns6.gandi.net. ;; Received 86 bytes from 2001:678:5::1#53(b.nic.io) in 60 ms Oh, well that's interesting, Gandi is a backup for their custom daemon, eh? So did they implement AXFR, IXFR, and notify and such to Gandi? Well, let's ask Gandi: [~]$ dig @ns6.gandi.net. SOA xip.io ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 3222 Oh, guess not. The long and short of this is for DNS purposes, a custom daemon is almost never the answer. This could have been accomplished with BIND fairly easily, and the zone would be functional as well.
- axiak 14y agoIt depends on what you're working on. If you're developing a SaaS application where an individual instance should be providing group features based on the hostname, suddenly host names becomes a development detail. Though I agree that in most web applications this isn't the case.
- jsprinkles 14y agoI'm sorry, I edited my comment (the broken zone is more troubling to me than the impetus for using it) and made yours look out-of-place. You responded to something accurate the first go, and I agree with you.
- sstephenson 14y agoPatches welcome.
- shawndrost 14y agoI've also made use of lvh.me (local virtual host), a url who's dns points at 127.0.0.1. It's good for testing subdomains on localhost.
- no_more_death 14y agolocalhost.microsoft.com and localhost.yahoo.com also used to redirect to 127.0.0.1. And, of course, this wreaked utter havoc with cookies (since cookies are accessible across the entire domain). Zalewski discusses in TTW (The Tangled Web). DNS hackery is really dangerous.
- shanselman 14y agoI like http://localtest.me http://localtest.me because it's the only one I've seen with a valid wild card SSL...makes testing and switching between HTTP and HTTPS easy.
- tsaixingwei 14y agoThis would be great for testing multi-tenanted cloud applications. For example: tenant1.10.0.0.1.xip.com tenant2.10.0.0.1.xip.com tenant3.10.0.0.1.xip.com They all resolve to the same IP Address (10.0.0.1), but now the web application at that address knows which tenancy is being targeted.
- recurser 14y agoYou can do this with pow if you're testing locally - tenant1.mydomain.dev, tenant2.mydomain.dev etc, and the URLs are a bit cleaner.
- LocalPCGuy 14y agoI'm not exactly why it is so hard to connect to a local machine on your network. Either determine your local IP address or your network computer name.
- dools 14y agoIf you're creating an application where connecting on the "root domain" matters it can be problematic. For example, imagine you were creating some URL rewrites using apache's mod_rewrite and they worked for http://some.domain.com/rewrite-goes-here/ http://some.domain.com/rewrite-goes-here/ you would have to do a bunch of extra work (or an extra set of rules even) to make that work also for 10.0.1.1/my_app_without_vhost/rewrite-goes-here/ When you're testing on your LAN using a PC/mac or whatever you can do a local DNS modification on the machine (eg. /etc/hosts) but when you're testing from an iPad or some other device this is either impossible or prohibitively difficult. The other option is to setup a DNS server on your LAN which is a headache all it's own - this is a very simple and elegant way of circumventing these issues. Awesome stuff.
- bencoder 14y agoYou really should develop your apps so that they are path agnostic. And the mod_rewrite rules can be fixed with a simple RewriteBase declaration (RewriteBase /subdirectory). I've never found this a major problem that requires a DNS server to fix.
- baby 14y agoI don't get it, it's pretty easy to install a wildcard system on one's server right? Why would we go through this?
- riobard 14y agoI have a dd-wrt router with DNSmasq functioning as the DNS server for local hosts. DNSmasq resolves external domains using Google DNS (8.8.8.8/8.8.4.4). With this setup, domain names like 192.168.X.X.xip.io and 127.X.X.X.xip.io won't resolve, and I believe there is something wrong with my DNSmasq setup. Anyone else ran into similar issues? (Update) Problem solved by myself. The DNSmasq config has stop-dns-rebind option enabled, which filters out DNS results in private IP ranges from upstream servers for security reasons. DNSmasq doc has the following part: -stop-dns-rebind Reject (and log) addresses from upstream nameservers which are in the private IP ranges. This blocks an attack where a browser behind a firewall is used to probe machines on the local network. In case you run into this issue, just comment out this option in dnsmasq.conf and restart dnsmasq.
- X-Istence 14y agoI run unbound as my recursive DNS resolver and it too strips those results out for security purposes.
- j-kidd 14y agoOr you can add rebind-domain-ok=xip.io to dnsmasq.conf. Not that I would do that myself, as I still don't see what value it provides.
- riobard 14y agoThanks for this tip! I guess this is more secure than just opening up all rebind from the wild.
- darrikmazey 14y agoI run a simple djbdns setup locally with a caching resolver that passes specific domains to my dns server proper and the rest up the chain. Took about seven minutes to configure properly. This seems overly complex.
- shellox 14y agoI can't really see the problem which it try to solve, but I guess some people need it.
- rmoriz 14y agoWhy not use mDNS/Bonjour?
- impoverished 14y agoCouldn't you accomplish this with djbdns' dnsrewrite or pdns_recursor's lua scripting? Why anyone would want to write DNS server (=something that needs to be very fast) in Javascript is beyond my comprehension. The ASCII art is probably better work than the DNS server.
- j-kidd 14y agoOr unbound's python scripting. Or if GeoScaling slightly improves its excellent smart subdomain service, 2 lines of php script.
- spobo 14y agoYou guys are missing the point. It's intended to be used with Pow. This way you don't have to bother with manually starting & stopping servers or remembering ports or whatever. This domain allows you to have access your sites in the same way from any device in your network. Not just your dev machine. Handy! And it works. What's not to like then? http://37signals.com/svn/posts/3191-announcing-pow-040-with-xipio-support http://37signals.com/svn/posts/3191-announcing-pow-040-with-...
- tijs 14y agoThis is pretty handy until were all switched over to IPv6 and we'll need to "to solve the problem once and for all" again.
- drbawb 14y agoIsn't the idea of IPv6 that we have plenty of addresses. Thus it wouldn't (read: shouldn't) be hard to get another address bound to your virtual host. In fact doesn't the whole idea of binding multiple sub-domains to the same IP address (on the same port) kind of go by the wayside when it's free/cheap/not-going-to-blow-up-the-internet to get another IP?
- tijs 14y agoyes you could indeed throw another address at your virtual host. but the website/tool in question won't work with IPv6 addresses as they are not valid in a URL is the point i was trying to make :)
- comice 14y agoI run a kinda related service that does instant dns records: http://ipq.co/ http://ipq.co/ And I wrote a Ruby DSL to easily integrate with a real dns server (powerdns). Makes it trivially easy to write things like xip.io https://github.com/johnl/powerdns_pipe https://github.com/johnl/powerdns_pipe
- comice 14y agoReimplemented in ~30 lines of ruby as a powerdns pipe backend. https://gist.github.com/2897076 https://gist.github.com/2897076 powerdns is a solid dns server and very extensible! $ host whatever.192.0.43.10.ip.ipq.co whatever.192.0.43.10.ip.ipq.co is an alias for 1h9u9ze.ip.ipq.co. 1h9u9ze.ip.ipq.co has address 192.0.43.10
- rs 14y agoI created a clone of xip.io which doesn't have any the DNS faults: http://news.ycombinator.com/item?id=4085522 http://news.ycombinator.com/item?id=4085522