[as112-ops] DNS timeouts

[Matthew Pounsett]

Copying Jonathan as he is not subscribed to the list.

> On Nov 23, 2021, at 09:29, Fajardo, Jonathan via as112-ops <as112-ops at dns-oarc.net> wrote:
> 
> 
> 
> I work on the network operations team for Teach For America.  We’ve recently come across an issue where our data center is getting timed out with reverse lookups.  I reached out to iana.org and they suggested I forward my issue to AS112 Operators.

Hi John

The “blackhole*” name servers you’re querying are meant to absorb lookups for RFC 1918 private address space that leak from private networks, to prevent that traffic from hitting the root servers, as it can be quite a heavy load.

RFC 1918 address space is not meant to be used on public networks, and it is not intended that DNS queries for addresses in that space should reach public DNS servers.  The AS112 project is there to absorb those queries when they leak.

The expected behaviour here is that you should configure your recursive name servers to handle that traffic, and not leak it to public network, which is sounds like you’ve started doing.

Some newer DNS software provides this automatically when operating as a recursive server, which may be of use to you.  Exactly how this is done is specific to the software you’re using, but here is some info on the BIND configuration:  <https://kb.isc.org/docs/aa-00800>

> The timeout is causing a delay in our ability to quickly SSH into our Linux boxes as they perform a reverse lookup on clients trying to connect.  We are mostly remote workers and have done a workaround by creating an internal DNS zone for our VPN network.  I have tried doing a lookup directly connected to internet at our data center and get the same issue (bypassing our firewalls and other network equipment).  When we try the lookup from one of our other offices, it works no problem.  Has our public IP for our data center been blocked in any way?  We advertise a 198.202.213.0/25 on our BGP

Setting up a local zone inside your VPN was the right thing to do, and will remove the need for you to query your local AS112 instance.

As for the timeouts, it’s unlikely you’re being filtered.  It’s more likely that the AS112 instance that your traffic is being routed to is down, overloaded, or experiencing some other issue.

As the AS112 project is volunteer operated, and not centrally managed, there’s no easy way for anyone here to help you based on the information supplied so far.  However, if you send a TXT query for hostname.as112.net you should get some information that will tell you where that local site gets responses from.  Something like this:

% dig +short IN TXT hostname.as112.net
"See http://www.as112.net/ for more information."
"Unique IP: 203.0.113.1."
"Hurricane Electric" "Fremont, California,USA”

If the instance is not responding, then traceroute or MTR output from the same IP address as the recursive server would be helpful in identifying where your traffic is going.

% mtr --report-wide -n blackhole-1.iana.org.
Start: 2021-11-23T15:48:15+0000
HOST: adm01.sjc.dns-oarc.net   Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- 2620:ff:c000::1           0.0%    10    0.6   0.6   0.5   0.7   0.1
  2.|-- 2001:504:30::ba00:6939:1  0.0%    10   70.6  14.9   0.4  70.6  24.3
  3.|-- 2001:470:0:1e7::1         0.0%    10    0.5   1.6   0.4  11.8   3.6
  4.|-- 2620:4f:8000::6           0.0%    10    0.4   0.4   0.4   0.5   0.0

That information might help someone on here identify if their instance is having problems, or might lead you to contact information so that you can notify the individual operator.

However, even if the problems at that AS112 instance are corrected, you should still continue to configure your recursive server to respond for the DNS queries for all networks you’re using inside your network.

I hope this has been helpful

Matt Pounsett
DNS-OARC Systems Engineering



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: Message signed with OpenPGP
URL: <https://lists.dns-oarc.net/mailman/private/as112-ops/attachments/20211123/a8fcd899/attachment.sig>