Iptables – Using LVS (Linux Virtual Server) for doing DNS HA

domain-name-systemhigh-availabilityiptablesload balancinglvs

I have been trying to create an LVS DNS HA using CentOS 6.x:

Piranha GUI to configure the DNS
Pulse is the HA heart of CentOS LB
IPTables to configure marks on the packets since DNS uses TCP and UDP 53

After several days, I find that I can not figure out how to make it work – and I was hoping that someone has either the lvs.cf file avaiable along with all iptables rules necessary. Or if someone has already used some other OpenSource & Free software that allows to do DNS LB (not round robine DNS A records – that's not what the purpose of this exercise is for).

If anyone has successfully made named DNS under LVS with two or more real-servers within the pool, work, I would greatly appreciate if the configurations could be posted:

lvs.cf
iptables rules to place

I am primarily looking for either Direct Server Return or NAT – either solution will work for me.

Thank you in advance.

Jim.

Best Answer

You should be able to configure DNS load balancing pretty easily with LVS in DR mode. Personally I would use Ldirectord rather than Piranaha (which is old and buggy), but either should work.

Like you said you will need to configure your firewall mark for the correct TCP and UDP ports, then load balance all packets that are marked to your backend server(s). I assume you won't need persistence for DNS (wouldn't work for UDP anyway).

I think the step you are probably missing is to allow the backend servers to respond to the traffic you are sending - commonly know as the ARP problem. If you have Windows servers then use this method. Or for Linux the simplest method is to use an iptables redirect:

iptables -t nat -A PREROUTING -p tcp -d <VIP> -j REDIRECT

Its explained in more detail on page 21 of the http://loadbalancer.org quick start guide.

If you need any help, post your config and I'll take a look.

Answer

The short answer to your specific question of listing CNAMEs is that you cannot without permission to do zone transfers (see How to list all CNAME records for a given domain?).

That said, if your company's DNS server still supports the ANY query, you can use dig to list the other records by doing:

dig +noall +answer +multiline yourdomain.yourtld any

These ... +noall +answer +multiline ... are strictly optional and are simply output formatting flags to make the output more easily human readable (see dig man page ).

Example

$ dig +noall +answer +multiline bad.horse any

Returns:

bad.horse.              7200 IN A 162.252.205.157
bad.horse.              7200 IN CAA 0 issue "letsencrypt.org"
bad.horse.              7200 IN CAA 0 iodef "mailto:abuse@sandwich.net"
bad.horse.              7200 IN MX 10 mx.sandwich.net.
bad.horse.              7200 IN NS a.sn1.us.
bad.horse.              7200 IN NS b.sn1.us.
bad.horse.              7200 IN SOA a.sn1.us. n.sn1.us. (
                                2017032202 ; serial
                                1200       ; refresh (20 minutes)
                                180        ; retry (3 minutes)
                                1209600    ; expire (2 weeks)
                                60         ; minimum (1 minute)
                                )

Caveats (RFC8482)

Note that, since around 2019, most public DNS servers have stopped answering most DNS ANY queries usefully. For background on that, see: https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/

If ANY queries do not enumerate multiple records, the only option is to request each record type (e.g. A, CNAME, or MX) individually.

Iptables – LVS Configuration issue (Using piranha Tool)

First, you need to decide what type of LVS you want: NAT, TUN, or DR.

[packet-forwarding-method]

      -g, --gatewaying  Use gatewaying (direct routing). This is the default.

      -i, --ipip  Use ipip encapsulation (tunneling).

      -m, --masquerading  Use masquerading (network access translation, or NAT).

You appear to want NAT so you'll need -m options to ipvsadm for your real servers.

A test piranha config is available here:

http://www.linuxvirtualserver.org/docs/ha/piranha.html

Rather than manually configuring the NAT with your own iptables rule, you let ipvsadm do the NAT for you. Delete your iptables rule, and for that matter, delete the aliased interfaces you specify above ending in :1. That will greatly simplify things and get you on the right track.

Make sure your default gw on your real servers in 192.168.3.1. From the Director, try pinging each of your realservers and also try telnetting to the LVS port(s) which look to be 5000/5004. If all that is working, go back to your client and try telnetting to 5000/5004 on your VIP.

Best Answer

Related Solutions

List all DNS records in a domain using dig

Answer

Example

Caveats (RFC8482)

Iptables – LVS Configuration issue (Using piranha Tool)

Related Topic