lost and found ( for me ? ): DNS64

Ecdysis provides DNS64 patch for unbound. download the patch as below URL.
http://ecdysis.viagenie.ca/download.html

I downloaded ecdysis-unbound-1.4.7.20101117.patch.gz.
This patch is for unbound 1.4.7. If you don’t have unbound 1.4.7 , plz download that ver.

unzip patch file.

# gunzip ecdysis-unbound-1.4.7.20101117.patch.gz

apply patch

# tar xzvf unbound-1.4.7.tar.gz
# cd unbound-1.4.7
# patch -p1 < ../ecdysis-unbound-1.4.7.20101117.pa
tch
patching file .gitignore
patching file Makefile.in
patching file dns64/dns64.c
patching file dns64/dns64.h
patching file doc/README.DNS64
patching file doc/example.conf.in
patching file services/modstack.c
patching file util/config_file.h
patching file util/configlexer.c
patching file util/configlexer.lex
patching file util/configparser.c
patching file util/configparser.h
patching file util/configparser.y
patching file util/data/msgreply.c
patching file util/data/msgreply.h
patching file util/fptr_wlist.c

- compile unbound.

# ./configure --disable-gost
# make
# make install

- edit unbound.conf to enable DNS64

Please note that “module-config” directive must start with “dns64”

module-config: "dns64 validator iterator"

add dns64-prefix in “server clause”

server:
dns64-prefix: 64:FF9B::/96

The prefix must be a /96 or shorter.

- fly unbound

# unbound-control start

- check unbound loads dns64 module

# unbound-control status
version: 1.4.7
verbosity: 1
threads: 1
modules: 3 [ dns64 validator iterator ]

# dig @::1 www.facebook.com aaaa

; <<>> DiG 9.8.0-P2 <<>> @::1 www.facebook.com aaaa
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19672
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.facebook.com. IN AAAA

;; ANSWER SECTION:
www.facebook.com. 14 IN AAAA 64:ff9b::45ab:e40d

If AAAA records exist , unbound doesn’t change a response.

# dig @127.1 www.isc.org aaaa

; <<>> DiG 9.8.0-P2 <<>> @127.1 www.isc.org aaaa
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44724
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 6

;; QUESTION SECTION:
;www.isc.org. IN AAAA

;; ANSWER SECTION:
www.isc.org. 600 IN AAAA 2001:4f8:0:2::d

[ What’s DNS64 and NAT64 ]

This technique enables a client which has only IPv6 addresses to access to IPv4 servers.

DNS64 : convert DNS reply from A to AAAA(DNS64)
NAT64 : do NAT from IPv6 to IPv4

IPv6 client ------- BIND configured DNS64 ----------- DNS Auth
       |
       ----------NAT64 ----------------- IPv4 servers
             ( IP NAT )
<--- IPv6 -----------------> <--------- IPv4 ----------->

If you want to know more details about DNS64 and NAT64 , plz see the following PDFs.
http://www.viagenie.ca/publications/2010-06-03-terena-nat64.pdf
http://fud.no/talks/20110524-IPv6_Forum_Norway-Life_Without_IPv4.pdf

Technique of DNS64 and NAT64 is :

IPv6 client sends AAAA queries to Cache DNS
Cache DNS sends AAAA queries to Auth DNS
Auth DNS returns empty answers ( there are no AAAA records )
Cache DNS sends A queries to Auth DNS
Auth DNS returns A answers
Cache DNS converts DNS answers from A to AAAA(DNS64) for IPv6 client
Cache DNS returns DNS64 answers to IPv6 client
IPv6 client accesses to IPv4 server via NAT64 device

[ How to configure DNS64 ]

BIND 9.8 has implemented DNS64.

Here’s an example of how to configure DNS64 in BIND 9.8.0-P2

You can configure DNS64 options in options statement or view statement.

options {
    dns64 64:FF9B::/96 {
    clients {
            any;
    };
    mapped { any; };
    suffix ::;
    recursive-only yes;
    break-dnssec yes;
};

before configuring DNS64

after configuring DNS64

# dig @::1 www.amazon.co.jp aaaa

; <<>> DiG 9.8.0-P2 <<>> @::1 www.amazon.co.jp aaaa
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49045
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 0

;; QUESTION SECTION:
;www.amazon.co.jp.           IN AAAA

;; ANSWER SECTION:
www.amazon.co.jp.    1       IN AAAA 64:ff9b::cfab:b587

;; AUTHORITY SECTION:
www.amazon.co.jp.    3606    IN NS ns-912.amazon.com.
www.amazon.co.jp.    3606    IN NS ns-911.amazon.com.
www.amazon.co.jp.    3606    IN NS ns-921.amazon.com.
www.amazon.co.jp.    3606    IN NS ns-923.amazon.com.

64:ff9b is a prefix
cfab:b587 is 207.171.181.135 ( = IPv4 address of www.amazon.co.jp )

# ipv6calc --quiet --action conv6to4 207.171.181.135 | awk -F: '{print $2,$3}'
cfab b587

Here’s an output of capture data when I did “dig @::1 www.amazon.co.jp aaaa”

BIND send A query and received an answer from NS of amazon.co.jp

Questions: 1
Answer RRs: 1
Authority RRs: 0
Additional RRs: 0
Queries
    www.amazon.co.jp: type A, class IN
        Name: www.amazon.co.jp
        Type: A (Host address)
        Class: IN (0x0001)
Answers
    www.amazon.co.jp: type A, class IN, addr 207.171.185.225
        Name: www.amazon.co.jp
        Type: A (Host address)
        Class: IN (0x0001)
        Time to live: 1 minute
        Data length: 4
        Addr: 207.171.185.225

convert a DNS reply from A to DNS64 and return DNS64(AAAA) answer to a resolver.

Queries
    www.amazon.co.jp: type AAAA, class IN
        Name: www.amazon.co.jp
        Type: AAAA (IPv6 address)
        Class: IN (0x0001)
Answers
    www.amazon.co.jp: type AAAA, class IN, addr 64:ff9b::cfab:b9e1
        Name: www.amazon.co.jp
        Type: AAAA (IPv6 address)
        Class: IN (0x0001)
        Time to live: 1 second
        Data length: 16
        Addr: 64:ff9b::cfab:b9e1
Authoritative nameservers
    www.amazon.co.jp: type NS, class IN, ns ns-911.amazon.com
        Name: www.amazon.co.jp
        Type: NS (Authoritative name server)
        Class: IN (0x0001)
        Time to live: 1 hour, 6 seconds
        Data length: 19
        Name server: ns-911.amazon.com

lost and found ( for me ? )

lost and found ( for me ? )

How to configure DNS64 in unbound

BIND : DNS64