AS112 provides an anycasted reverse DNS sink hole for the private addresses set aside in RFC1918 and RFC6890. Using BIRD to inject an AS112 instance into your own system is quick, easy, and painless!
This is nearly identical to using exabgp, except that in this case we’ll be installing routes to the kernel.
- BGP: your own autonomous system, plus we’ll be operating AS112 which will announce/service the following prefixes:
- BIRD 1.6.x
- DNS server (BIND, NSD, etc)
- RFC 6304: AS112 Nameserver Operations Historical, Obseleted by RFC 7534
- RFC 6305: I’m Being Attacked by PRISONER.IANA.ORG!
- RFC 7534: AS112 Nameserver Operations
- RFC 7535: AS112 Redirection Using DNAME
As mentioned in other my blogs about Exabgp, Linux is funny about loopback type addresses. I was unable to get Debian to reliably bring up the interfaces I wanted so I ended up just putting them in
rc.local which is a hack, but it works reliably at least.
The IPv4 and IPv6 interfaces for the system can be set up almost as normal, MINUS a default route. We will be installing routes from BGP to the system, and advertising the anycasted prefix outbound.
RFC7534 lays out the configs in BIND style pretty well. Essentially, the most important things are:
- Any DNS server that can host the zones will work, BIND, NSD, PowerDNS, etc will all work. The configs just come specified in the RFC for BIND.
- host the critical zones:
- RFC1918 reverse zones (db.dd-empty)
- RFC6890 reverse zone (db.dd-empty)
- hostname.as112.net (db.hostname.as112.net)
- hostname.as112.arpa (db.hostname.as112.arpa)
- empty.as112.arpa (dd.dr-empty)
- Listen on the anycast addresses on V4 and V6
BIRD, configs + healthchecks
I am not healthchecking the service yet. However when the pseudointerface is downed, BGP stops advertising it so that will make it easy to react. There is existing scripts I should look at as well.
Experience so far
Everything’s worked as expected. I’ve run a bunch of
dig’s to check which instance I’m talking to:
dig @184.108.40.206 hostname.as112.net. txt +short
It always returns one of my instances, either my BIRD or my exabgp one.
I expect that I’ll set up unixsurfer/anycast_healthchecker at some point soon.