2

I am trying to setup a nameserver in a testing environment to route traffic to two different OpenStack Swift Proxy Servers using a simple round robin method. I am trying to use BIND9 to accomplish this, but I am having issues getting the IP to resolve correctly. I have patched this together through trial and error with internet research, so there are likely gaps in my understanding of BIND.

All servers are Ubuntu 11.04 server images

I have updated the /etc/resolv.conf to an additional nameserver line above the current nameserver line with the IP address of the gateway box.

The named.local.conf:

zone "mygateway.com" {
    type master;
    file "mygateway.com.db";
};
zone "183.9.15.in-addr.arpa" {
    type master;
    file "rev.183.9.15.in-addr.arpa";
};

The mygateway.com.db file:

; BIND data file for local loopback interface
;
$TTL    499
@   IN  SOA ns admin (
             201006     ; Serial
             604800     ; Refresh
              86400     ; Retry
            2419200     ; Expire
             604800 )   ; Negative Cache TTL
;
@   IN  NS  ns1
ns1 IN  A   15.9.183.217
gw.mygateway.com    IN  A   15.9.183.217
        TXT "Swift Gateway"
www IN  A   15.9.183.223    ; IP address of server1
www IN  A   15.9.183.216    ; IP address of server2

The rev.183.9.15.in-addr.arpa file:

;
; BIND data file for local loopback interface
;
$TTL    499
@   IN  SOA ns1.mygateway.com admin.mygateway.com (
             201007     ; Serial
             604800     ; Refresh
              86400     ; Retry
            2419200     ; Expire
             604800 )   ; Negative Cache TTL
;
@   IN  NS  ns1
ns1 IN  A   15.9.183.217
217 IN  PTR mygateway.com
www IN  A   15.9.183.223
www IN  A   15.9.183.216

dig output is:

$ dig -x 15.9.183.217

; <<>> DiG 9.7.3 <<>> -x 15.9.183.217
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9011
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;217.183.9.15.in-addr.arpa. IN  PTR

;; ANSWER SECTION:
217.183.9.15.in-addr.arpa. 499  IN  PTR mygateway.com.183.9.15.in-addr.arpa.

;; AUTHORITY SECTION:
183.9.15.in-addr.arpa.  499 IN  NS  ns1.183.9.15.in-addr.arpa.

;; ADDITIONAL SECTION:
ns1.183.9.15.in-addr.arpa. 499  IN  A   15.9.183.217

;; Query time: 0 msec
;; SERVER: 15.9.183.217#53(15.9.183.217)
;; WHEN: Wed Jul 20 01:30:34 2011
;; MSG SIZE  rcvd: 105

I am runnning the swauth-prep command, which takes the gateway http as argument to access the REST api like (8080 is configured for https on the proxy servers):

swauth-prep -K mykey -A https://15.9.183.217:8080/auth

Does this configuration look correct for round robin distribution?

Is there are way that I can verify the round robin is working? (via dig or other command line operation)

1 Answer 1

5

Your forward zone is correct for DNS round-robin (one hostname, two addresses). You can confirm that your DNS server is returning both records by running dig www.mygateway.com. You should receive two A records.

Your reverse zone IS NOT configured correctly for round-robin DNS. What you've created there are entries for www.183.9.15.in-addr.arpa, which will both be returned, and one picked by the client's resolver library. This is definitely not what you want.
What you probably want are records like:

216    IN   PTR www.mygateway.com.
223    IN   PTR www.mygateway.com.

which will ensure that reverse DNS lookups for 15.9.183.216 and 15.9.183.223 return "www.mygateway.com" (and therefore match the forward A records).

Remember that round-robin DNS doesn't guarantee even load distribution: The choice of which record to use is made by the client resolver library and may be decided randomly, by which record was received first, by which record was received last, or any other method some drunk programmer came up with while hacking together a resolver library.

DNS round-robin is cheap and reasonably effective, but if you need good load balancing you may want to invest in load-balancing hardware (or software - pf, HAProxy, etc.).


Obligatory plug: Your question and some of the mistakes you made above imply a fundamental misunderstanding of some basic DNS concepts. I strongly suggest picking up a copy of DNS and BIND (electronically or from your local bookstore) and reading through it - at least chapters 1, 5 and 6, and in your case the relevant part of chapter 10.

The time you save by doing so will far outweigh the price of the book.

2
  • thanks for your help, I got something working, fortunately there are real SA folks to configure the actual setup :)
    – Rob Parker
    Jul 20, 2011 at 17:07
  • From what I read, the book you suggest is now rather outdated... The BIND9 Administrator Reference Manual is probably generally better to know of all the details. Jan 20, 2022 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .