Hacker News Reader

Comment by grizzles | Hacker News Reader

Any chance for split horizon dns? The ability to perma-name all my home computers is something I've always wanted in a home router.

View on HN

https://godoc.org/github.com/rtr7/router7/cmd/dnsd already resolves computer names from DHCP leases. Is that what you mean? If no, can you elaborate on what the use-case is?

Edit: forgot to mention, you can use static leases, too, permanently assigning an IP/hostname to a MAC address: just remove the expiration field in /perm/dhcp4d/leases.json :)

Here's a use case that I am currently doing at home:

I have a live weather station [1] that pulls data from a Go-based service that I wrote and run on a server on my home network. When I'm outside of the house, mhkweather.com resolves to a Digital Ocean IP, where I run a proxy to forward requests back to home IP. However, when I'm at home, mhkweather.com resolves to a local 10.x.x.x IP and goes straight the the local service, no proxy. It faster this way. I want to be able to set DNS overrides for local things. I can do this with unbound but it would be nice if dnsd could do this for me.

[1] https://mhkweather.com

Thanks for elaborating.

For the time being, you’d need to modify dnsd to install your custom handler. It should be as simple as adding another server.mux.HandleFunc call in internal/dns/dns.go.

If this turns out to be a feature which many people would like, I’ll think about how to best structure the code to make this easier.

Oh cool re: dnsd

This seems to be a standard feature in many routers now. The computer name sent with the DHCP request will eventually land in the resolver's hosts table and it will respond to DNS requests as expected. It's client-controlled, which is kind of not great, but for home users it works as intended.

What I'd like to see is a home router that lets me put arbitrary rules in. Currently I use dnsmasq as a resolver and it basically does what I need, but I'd rather have it running on the router instead of needing another computer.

My current rule set is roughly:

* Resolve from local hosts file - this is where I put my statically assigned home servers/devices.

* If the domain request matches .domain.tld, forward it to a.b.c.d for resolution - this is a dnsmasq running on a remote box and covers off VMs that I run there. There is an IPSec tunnel (running on a small VM) and static routes on my router that handle getting to that box.

Finally, pass the request onto my router which will pass it onto my ISP or use its local DHCP-driven hosts table to resolve it.

I'd love it if an off-the-shelf router could do this. Currently I'm using a UniFi Security Gateway and it seems like this feature set would be a good fit. The router is professional-enough that advanced features like this make sense.

Have a look at router7’s dnsd, it’s not that complicated: https://github.com/rtr7/router7/blob/master/cmd/dnsd/dnsd.go You could easily fork it and extend it to implement your custom rules.

I’ve done Go cross-compilation for running on Ubiquiti gear before, and it worked. So, if you’re willing to spend the effort, you could do it :).

I have this set up in my house. I have a tld and internally I want the IP to resolve to the land IP and externally, to the ISP ip. I also have local caching for things like imap, but slow uploaded so I don't host my full email and web mail stack there.

I run 2 dns servers usually on the same box on different bind addresses. You'd run a caching resolver on the gw ip and forward requests for my.tld to the second resolver which is configured to be authoritative for my.tld. the hosts can then be configured either through DHCP or statically.

This is a pretty common technique to make enterprises Intranets.

Added benefit is that when you did a file transfer between Lan hosts with the globally accessable DNS, the transfer stays on the LAN. Also ssh host works in you ssh config regardless of location.

Which Ubiquiti gear? I wasn't expecting one component to be on MIPS, one component to be on ARM7 without hardfloat and one component to be ARM7-A with vfp4.

I guess Go's cross compilation makes it easier.

PS: Without hardware offload, the 8 port POE switch only manages 12 megabits / second.

In my case, I was cross-compiling for the EdgeRouter Lite, which is a MIPS device.

I'm running a similar setup (although without IPsec). My compromise was to have name.int.my.domain resolve internally and name.my.domain resolve externally (easier with ipv6).

dnsmasq should be able to do what you want to do and it can be enabled on the USG - at least from the controller.

Why do you need split horizon DNS for that?

So if I ssh into another computer by it's name everything works without me having to maintain a static device table somewhere w/scripts to deal with inevitable versioning issues.

You don’t need split horizon dns as long as the router is running a resolver. Just configure the resolver to use some TLD (eg .local) as a local network so that it looks up any names ending in eg .local in its local /etc/hosts or equivalent.

.local isn't a recommendation any more due to zeroconf.

The "best way" is to use a real domain for your local network. But this can be annoying, costs money and has other issues (renaming/-branding, mergers/splits, domain squatting, accidental record publication and so on ---- it's a lot like renting an internet-routable IP network for LAN use, it's kinda silly and error prone).

Using non-private IP for your local network isn't "silly", it's just that we've grown accustomed to not doing so out of necessity. Reusing the same IP address for multiple hosts is problematic, even when there is an RFC that says it's okay to do so.

For instance, I've got a tinc VPN network setup between many of my hosts. What IP range should I set that to such that it will not clash with whatever access network my laptop roams onto? The proper IP-philosophy answer is to apply for a block, even if it's never announced by BGP.

The pragmatic hack is to attempt to choose the most obscure block that isn't likely to conflict with the public Internet or with how local networks are generally setup. In my case, I chose something NOT from RFC1918 (so shoot me).

It's of course less of a big deal if you do realm / split-horizon based routing. But that is not straightforward to setup, as it's getting away from how IP was designed to be used.

What about .internal? https://tools.ietf.org/html/draft-wkumari-dnsop-internal-00

That draft has expired... so it's not official.

I just learned this however: https://www.icann.org/resources/board-material/resolutions-2...

So .corp and .home will not become gTLDs and should be relatively safe to use.

Ugh! It really is a situation of “we (ICANN) took money from people applying for these and don’t have the guts to officially say ‘no these are reserved for private usage, deal with it’ so we’ll call it ‘delay allocating these names indefinitely’”. At least they’re planning on refunding the applicants. And Google has the clout to push for making say .dev closed off via an RFC but instead bought it and runs it for their own (internal) development. It’s like no one has the concept of thinking about working for the public good for small groups or individuals on this modern internet. Tragedy of the commons.

Internet-routable (v6) addresses on home LAN is a pretty standard thing and not silly at all. In many places you still get multiple v4 addresses too.

I posted how to do split horizon above. I get it. You don't want to change your ssh config and doing things on lan instead of going through the router interfaces is ideal.

Like the other person said that's just a normal DNS lookup, not split horizon. Use one of the private TLDs like .test or .local.

Reply on news.ycombinator.com