CN115604223A - Method for realizing VPC private domain name resolution supported by DNS - Google Patents

Method for realizing VPC private domain name resolution supported by DNS Download PDF

Info

Publication number
CN115604223A
CN115604223A CN202211029685.3A CN202211029685A CN115604223A CN 115604223 A CN115604223 A CN 115604223A CN 202211029685 A CN202211029685 A CN 202211029685A CN 115604223 A CN115604223 A CN 115604223A
Authority
CN
China
Prior art keywords
dns
domain name
request
vpc
source
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202211029685.3A
Other languages
Chinese (zh)
Other versions
CN115604223B (en
Inventor
汤新
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Unicloud Technology Co Ltd
Original Assignee
Unicloud Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Unicloud Technology Co Ltd filed Critical Unicloud Technology Co Ltd
Priority to CN202211029685.3A priority Critical patent/CN115604223B/en
Publication of CN115604223A publication Critical patent/CN115604223A/en
Application granted granted Critical
Publication of CN115604223B publication Critical patent/CN115604223B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00Traffic control in data switching networks
    • H04L47/10Flow control; Congestion control
    • H04L47/12Avoiding congestion; Recovering from congestion
    • H04L47/125Avoiding congestion; Recovering from congestion by balancing the load, e.g. traffic engineering

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention provides a method for realizing VPC private domain name resolution supported by a DNS, which comprises the following steps: s1, a cloud host in a VPC initiates a DNS request to a VIP +53 port of a DNS proxy in a Region; s2, an OVS is arranged in front of a DNS proxy, after the OVS receives the DNS request through a VIP, a source IP, a source Port and a VPC VNI are obtained, the VNI is converted into an IP address of V4, a source address is modified, the source Port keeps still, and a request is sent to an RS of a certain DNS proxy behind; s3, the DNS proxy judges whether the requested domain name is an authorized domain name or a private domain name, if not, the requested domain name is forwarded to a local DNS of a regional operator of the Region: s4, deploying a plurality of DNS clusters in different places, deploying LB for each DNS cluster, and judging after the DNS-LB receives the request. The invention has the beneficial effects that: the habit is met: the user no longer needs to access the service by memorizing the IP address; high availability: and the domain name mode is convenient for service scheduling, and cross-region load balancing can be supported.

Description

Method for realizing VPC private domain name resolution supported by DNS
Technical Field
The invention belongs to the technical field of cloud computing, and particularly relates to a method for realizing VPC private domain name resolution supported by a DNS (Domain name Server).
Background
Domain name resolution (DNS) is a service for converting a Domain name into an IP address, so that people can conveniently access a website through the Domain name, and is one of important components of the Internet.
Disclosure of Invention
In view of the above, the present invention is directed to a method for implementing DNS to support VPC private domain name resolution, so as to solve at least one problem in the background art.
In order to achieve the purpose, the technical scheme of the invention is realized as follows:
a method for realizing VPC private domain name resolution supported by DNS includes the following steps:
s1, a cloud host in a VPC initiates a DNS request to a VIP +53 port of a DNS proxy in a Region;
s2, an OVS is arranged in front of the DNS agent, after the OVS receives the DNS request through a VIP, a source IP, a source Port and a VPC VNI are obtained, the VNI is converted into an IP address of V4, a source address is modified, the source Port keeps still, and a request is sent to an RS of a certain DNS agent behind;
s3, the DNS proxy judges whether the requested domain name is an authorized domain name or a private domain name, and if not, the domain name is forwarded to a local DNS of a Region local operator:
s4, deploying a plurality of DNS clusters in different places, wherein each DNS cluster needs to deploy LB, and DNS-LB receives the request and then judges;
s5, judging after the DNS cache receives the request;
s6, after receiving the DNS request, the authoritative DNS converts the ECS into the VNI, confirms the tenant by combining the RegionID, performs service processing according to the configuration of the tenant and responds to the DNS cache;
s7, after receiving the response, the DNS cache caches and responds to the DNS proxy, and the DNS proxy caches and responds to the response;
and S8, after the DNS proxy responds, forwarding the source ip recorded before the OVS to the client.
Further, in step S3:
the method for judging the authorized domain name is that the domain name is directly distinguished according to domainname through the whole zone;
the method for judging the private domain name comprises the steps that the region ID + VNI + domainname is issued to a configuration file from a management system, and a DNS proxy reads the configuration file for matching judgment;
if the judgment result is yes, the source IP and the RegionID of the request are converted into the IP address of the IPV6, the ECS field of the EDNS is put in, and the DNS proxy initiates a recursive query to the DNS cluster.
Further, in step S4:
judging whether the request has an ECS field, if so, transmitting transparently, and if not, setting the ECS field as a request source IP;
if the requested domain name is an authorized domain name and the source IP is a public network address, directly forwarding to an authorized DNS;
if the source IP is a private network IPv6 address, forwarding to a DNS cache.
Further, in step S5:
judging whether the domain name is a private domain name, if not, rejecting the service or recursing to a public network DNS;
if so, the request continues for authoritative DNS.
Further, an electronic device is disclosed, which includes a processor and a memory communicatively coupled to the processor and configured to store instructions executable by the processor, wherein the processor is configured to perform a method for implementing DNS-supported VPC private domain name resolution.
Further, a server is disclosed that includes at least one processor, and a memory communicatively coupled to the processor, the memory storing instructions executable by the at least one processor, the instructions being executable by the processor to cause the at least one processor to perform a method for implementing DNS-supported VPC private domain name resolution.
Further, a computer readable storage medium is disclosed, storing a computer program, which when executed by a processor implements a method for implementing DNS-supported VPC private domain name resolution.
Compared with the prior art, the method for realizing VPC private domain name resolution supported by DNS has the following beneficial effects:
(1) The method for realizing VPC private domain name resolution supported by DNS accords with the habit, and a user does not need to access the service by memorizing the IP address;
(2) The method for realizing VPC private domain name resolution supported by the DNS is high in availability, facilitates the scheduling of services in a domain name mode, and can support cross-region load balancing;
(3) The method for realizing VPC private domain name resolution supported by DNS is flexibly controlled, and intranet domain names including domain names registered by others can be added or customized without limit; the same domain name can be used in the production system and the non-production system, and different resolutions are configured, so that the user service is convenient to issue and manage;
(4) The method for realizing VPC private domain name resolution supported by DNS is safe and isolated, private domain name configuration cannot be inquired on the Internet, internal service information and internal system architecture are protected, domain name resolution of different VPCs communicates through different tunnels, and complete isolation among different tenants is realized.
Detailed Description
It should be noted that the embodiments and features of the embodiments may be combined with each other without conflict.
The present invention will be described in detail with reference to examples.
The current DNS domain name resolution commonly uses three modes of local DNS, authorized DNS and global load balancing GSLB:
1. the local DNS mode refers to a DNS service closest to a client device, is an automatically allocated or manually configured DNS by a user, comprises DNS (Jiangsu telecom: 218.2.135.1, tianjin Union: 202.99.96.68) or public DNS (114.114.114.114, 8.8.8.8) of each province operator, receives a DNS query request of the user, and forwards the request to a corresponding authorized DNS in a recursive manner.
2. The authoritative DNS model is for a specific domain name, and generally it can be said what the authoritative DNS of a certain domain name is, each domain name can designate a corresponding NS record at the time of registration, that is, designate the authoritative DNS of the domain name, which is divided into two cases, one is that a domain name provider is managing and is responsible for authoritative resolution of the domain name purchased at the domain name provider; the other is a self-built authorized DNS, which is managed and analyzed by a domain name owner and all levels of sub domain names.
3. The global load balancing GSLB mode is a special authorized DNS running on the Internet, is the key of CDN (content delivery network) technology, and can carry out intelligent scheduling according to the IP of a DNS request source on the basis of analyzing a specific IP address, wherein the intelligent scheduling comprises distinguishing the geographic position of a client to realize near access and distinguishing the line of an ISP operator to realize in-network access, and in addition, the high availability of analyzed service can be ensured by adding a health check mechanism;
based on the local DNS and the authorized DNS mode, the invention uses the GSLB to distinguish the IP address of the request source, increases the characteristics of transmitting and identifying the VPC identification, deploys the local DNS in the AZ (available area) where different VPCs are located, collects and transmits the Region number and the VPC number while the local DNS converges and forwards the cached DNS request, deploys the authorized DNS cluster in different places in the whole country, and the DNS cluster can also recognize the VPC identification and distinguish and analyze the VPC identification on the basis of realizing the common DNS request, namely realizing that the analysis results of a domain name in different VPC identification domains are different, namely the domain name is privately analyzed.
In order to realize the method for DNS to support VPC private domain name resolution, the invention realizes the functions of source IP identification, tenant identification, cache forwarding, line self-definition, load balancing and the like in a software mode.
The DNS is deployed in a cluster mode and is divided into a DNS proxy, a DNS load, a DNS cache and an authoritative DNS. The DNS agent needs to sink and deploy in an AZ available area because the tenant identification needs to be transmitted and is transmitted in a two-layer network by VXLAN ID, and the DNS is an application layer protocol, so that a preposed openvswitch service is needed to realize the analysis, identification and processing of a two-layer message, and the tenant identification is extracted from the two-layer message and is placed in an ECS (Extended Client Subnet, a network segment where a Client IP (Internet protocol) is located) field of the DNS protocol; the DNS load, the DNS cache and the authoritative DNS are deployed in a three-layer cluster mode, and the allopatric cluster provides services for DNS proxies and a public network by a plurality of NS records such as NS1, NS2 and the like; the client side directly requests the DNS proxy, the DNS proxy forwards the request to the authorized DNS cluster, and the authoritative DNS judges the VPC identification and distinguishes and analyzes according to the content of the ECS.
In addition, the DNS needs to support caching and load balancing to improve the performance and the availability of the cluster, the DNS proxy also has a DNS caching function, the DNS cache needs to distinguish caching according to different ECSs, data safety and user privacy protection are met, the ECS cannot be accurate to the address of a client side but is blurred into a network segment (IPV 4 is 24-bit mask, IPV6 is 56-bit mask), and switch control is designed to determine whether to be started according to scene configuration.
The service implementation flow of the scheme is described as follows:
1.cloud host (VM) in VPC initiates DNS request (UDP or TCP) to VIP +53 port of DNS proxy in Region;
2. an OVS (openvswitch) is arranged in front of a DNS proxy, after the OVS receives a DNS request through a VIP, a source IP, a source Port and a VPC VNI are obtained, the VNI is converted into an IP address (xx.xx.xx.xx.xx/24) of V4, the source address is modified, the source Port is kept still, and a request is initiated by an RS of a certain DNS proxy at the rear part;
the DNS proxy judges whether the requested domain name is an authorized domain name or a private domain name, and if not, the domain name is forwarded to a local DNS of a Region local operator:
a) How to judge the authorized domain name: the whole zone is directly distinguished according to domainname;
b) How to judge the private domain name: the method comprises the following steps that 1, a RegionID + VNI + domainname is issued from a management system, and a DNS agent reads configuration file matching judgment;
c) If yes, converting the source IP and the RegionID of the request into the IP address of the IPV6, putting the IP address into an ECS field of the EDNS, and initiating a recursive query to a DNS cluster (through a public network) by the DNS proxy; IPV6 local address field FC 00:/8, using the first 56 bits to carry out identification, and conforming to the privacy specification of ECS
Figure BDA0003816166170000061
4. Deploying a plurality of DNS clusters in different places, wherein each DNS cluster needs to deploy LB (a plurality of ns records can be randomly used by local DNS), and after receiving a request, the DNS-LB receives the request
a) Judging whether the request has an ECS field, if so, transmitting transparently, and if not, setting the ECS field as a request source IP;
b) If the requested domain name is an authorized domain name and the source IP is a public network address, directly forwarding to an authorized DNS;
c) If the source IP is the private network IPv6 address, forwarding to the DNS cache
After DNS cache receives request
a) Judging whether the domain name is a private domain name, if not, rejecting the service or recursing to a public network DNS
b) If so, continuing to request authoritative DNS
6. After receiving the DNS request, the authoritative DNS converts the ECS into the VNI, confirms the tenant by combining the RegionID, performs service processing according to the configuration of the tenant and responds to the DNS cache
And 7, caching and responding to the DNS proxy after the DNS cache receives the response, caching and responding by the DNS proxy,
after DNS proxy response, forwarding to client according to source ip recorded before OVS
Those of ordinary skill in the art will appreciate that the elements and method steps of the examples described in connection with the embodiments disclosed herein may be embodied in electronic hardware, computer software, or combinations of both, and that the components and steps of the examples have been described in a functional general in the foregoing description for the purpose of clearly illustrating the interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the technical solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
In the several embodiments provided in the present application, it should be understood that the disclosed method and system may be implemented in other ways. For example, the above described division of elements is merely a logical division, and other divisions may be realized, for example, multiple elements or components may be combined or integrated into another system, or some features may be omitted, or not executed. The units may or may not be physically separate, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiments of the present invention.
Finally, it should be noted that: the above embodiments are only used to illustrate the technical solution of the present invention, and not to limit the same; while the invention has been described in detail and with reference to the foregoing embodiments, it will be understood by those skilled in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some or all of the technical features may be equivalently replaced; such modifications and substitutions do not depart from the spirit and scope of the present invention, and they should be construed as being included in the following claims and description.
The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents, improvements and the like that fall within the spirit and principle of the present invention are intended to be included therein.

Claims (7)

1. A method for realizing VPC private domain name resolution supported by DNS is characterized by comprising the following steps:
s1, a cloud host in a VPC initiates a DNS request to a VIP +53 port of a DNS proxy in a Region;
s2, an OVS is arranged in front of the DNS agent, after the OVS receives the DNS request through a VIP, a source IP, a source Port and a VPC VNI are obtained, the VNI is converted into an IP address of V4, a source address is modified, the source Port keeps still, and a request is sent to an RS of a certain DNS agent behind;
s3, the DNS proxy judges whether the requested domain name is an authorized domain name or a private domain name, if not, the requested domain name is forwarded to a local DNS of a regional operator of the Region:
s4, deploying a plurality of DNS clusters in different places, wherein each DNS cluster needs to deploy LB, and DNS-LB receives the request and then judges;
s5, judging after the DNS cache receives the request;
s6, after receiving the DNS request, the authoritative DNS converts the ECS into the VNI, confirms the tenant by combining the RegionID, performs service processing according to the configuration of the tenant and responds to the DNS cache;
s7, after receiving the response, the DNS cache caches and responds to the DNS proxy, and the DNS proxy caches and responds to the DNS proxy as well;
and S8, after the DNS proxy responds, forwarding the source ip recorded before the OVS to the client.
2. The method for implementing DNS supporting VPC private domain name resolution according to claim 1, wherein in step S3:
the method for judging the authorized domain name is that the domain name is directly distinguished according to domainname through the whole zone;
the method for judging the private domain name comprises the steps that the region ID + VNI + domainname is issued to a configuration file from a management system, and a DNS proxy reads the configuration file for matching judgment;
if the judgment result is yes, the source IP and the RegionID of the request are converted into the IP address of the IPV6, the ECS field of the EDNS is put in, and the DNS proxy initiates a recursive query to the DNS cluster.
3. The method for implementing DNS supporting VPC private domain name resolution according to claim 1, wherein in step S4:
judging whether the request has an ECS field, if so, transmitting transparently, and if not, setting the ECS field as a request source IP;
if the requested domain name is an authorized domain name and the source IP is a public network address, directly forwarding to an authorized DNS;
if the source IP is a private network IPv6 address, forwarding to a DNS cache.
4. The method for implementing DNS supporting VPC private domain name resolution according to claim 1, wherein in step S5:
judging whether the domain name is a private domain name, if not, rejecting the service or recursing to a public network DNS;
if so, the request continues to the authoritative DNS.
5. An electronic device comprising a processor and a memory communicatively coupled to the processor and configured to store processor-executable instructions, wherein: the processor is configured to perform a method of any one of claims 1 to 4 for implementing DNS with VPC private domain name resolution.
6. A server, characterized by: comprising at least one processor, and a memory communicatively coupled to the processor, the memory storing instructions executable by the at least one processor, the instructions being executable by the processor to cause the at least one processor to perform a method of implementing DNS support for VPC private domain name resolution as claimed in any one of claims 1 to 4.
7. A computer-readable storage medium storing a computer program, characterized in that: the computer program when executed by a processor implements a method of implementing DNS with VPC private domain name resolution as claimed in any one of claims 1-4.
CN202211029685.3A 2022-08-25 2022-08-25 Method for realizing DNS to support VPC private domain name resolution Active CN115604223B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202211029685.3A CN115604223B (en) 2022-08-25 2022-08-25 Method for realizing DNS to support VPC private domain name resolution

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202211029685.3A CN115604223B (en) 2022-08-25 2022-08-25 Method for realizing DNS to support VPC private domain name resolution

Publications (2)

Publication Number Publication Date
CN115604223A true CN115604223A (en) 2023-01-13
CN115604223B CN115604223B (en) 2024-10-11

Family

ID=84843983

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202211029685.3A Active CN115604223B (en) 2022-08-25 2022-08-25 Method for realizing DNS to support VPC private domain name resolution

Country Status (1)

Country Link
CN (1) CN115604223B (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117938808A (en) * 2024-03-21 2024-04-26 北京火山引擎科技有限公司 Domain name resolution method, system, device, equipment and medium for edge calculation

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120096166A1 (en) * 2010-10-15 2012-04-19 Brocade Communications Systems, Inc. Domain name system security extensions (dnssec) for global server load balancing
CN107231409A (en) * 2017-05-08 2017-10-03 北京三快在线科技有限公司 DNS data processing method, device, storage medium and computer equipment
US10033692B1 (en) * 2017-10-05 2018-07-24 Cloudflare, Inc. Managing domain name system (DNS) queries using a proxy DNS server
US10033691B1 (en) * 2016-08-24 2018-07-24 Amazon Technologies, Inc. Adaptive resolution of domain name requests in virtual private cloud network environments
CN109729189A (en) * 2019-03-14 2019-05-07 北京百度网讯科技有限公司 Method and apparatus for configuring domain name
CN112054941A (en) * 2020-09-07 2020-12-08 平安科技(深圳)有限公司 Automatic testing method, device and equipment for private domain name and storage medium
CN113438307A (en) * 2021-06-22 2021-09-24 北京金山安全软件有限公司 Domain name resolution method, server, system and storage medium

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120096166A1 (en) * 2010-10-15 2012-04-19 Brocade Communications Systems, Inc. Domain name system security extensions (dnssec) for global server load balancing
US10033691B1 (en) * 2016-08-24 2018-07-24 Amazon Technologies, Inc. Adaptive resolution of domain name requests in virtual private cloud network environments
CN107231409A (en) * 2017-05-08 2017-10-03 北京三快在线科技有限公司 DNS data processing method, device, storage medium and computer equipment
US10033692B1 (en) * 2017-10-05 2018-07-24 Cloudflare, Inc. Managing domain name system (DNS) queries using a proxy DNS server
CN109729189A (en) * 2019-03-14 2019-05-07 北京百度网讯科技有限公司 Method and apparatus for configuring domain name
CN112054941A (en) * 2020-09-07 2020-12-08 平安科技(深圳)有限公司 Automatic testing method, device and equipment for private domain name and storage medium
CN113438307A (en) * 2021-06-22 2021-09-24 北京金山安全软件有限公司 Domain name resolution method, server, system and storage medium

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117938808A (en) * 2024-03-21 2024-04-26 北京火山引擎科技有限公司 Domain name resolution method, system, device, equipment and medium for edge calculation
CN117938808B (en) * 2024-03-21 2024-06-21 北京火山引擎科技有限公司 Domain name resolution method, system, device, equipment and medium for edge calculation

Also Published As

Publication number Publication date
CN115604223B (en) 2024-10-11

Similar Documents

Publication Publication Date Title
US10911399B2 (en) Robust domain name resolution
US11743190B2 (en) Techniques for steering network traffic to regions of a cloud computing system
CN108886540B (en) Domain name resolution method, device and computer readable storage medium
US9712422B2 (en) Selection of service nodes for provision of services
US9444781B2 (en) Recursive DNS nameserver
CN106375492B (en) CDN service processing method, related equipment and communication system
JP5150769B2 (en) Updating routing information using request routing and client location information
US8249081B2 (en) Dynamic virtual private network (VPN) resource provisioning using a dynamic host configuration protocol (DHCP) server, a domain name system (DNS) and/or static IP assignment
US8902743B2 (en) Distributed and scalable network address translation
AU2020202148A1 (en) Rule-based network-threat detection
US6789125B1 (en) Distributed network traffic load balancing technique implemented without gateway router
US10009271B2 (en) Routing method and network transmission apparatus
US7443825B2 (en) Method and apparatus for providing a stand-alone wireless web service
EP2866386B1 (en) Domain name system and domain name service method based on user information
US20030039240A1 (en) Methods, systems and computer program products for accessing an embedded web server on a broadband access terminal
WO2016160672A1 (en) Traffic delivery using anycast and end user-based mapping in an overlay network
CN115604223A (en) Method for realizing VPC private domain name resolution supported by DNS
CN105282269A (en) Local DNS root server configuration method and service method
US10033830B2 (en) Requesting web pages and content rating information
CN116545982A (en) Method for realizing VPC private domain name resolution based on DNS RPZ mechanism
US10122630B1 (en) Methods for network traffic presteering and devices thereof
KR101345372B1 (en) System and Method for servicing domain name based on user information
CN112769970B (en) Method and system for DNS ECS intelligent transparent transmission
Nikkel Domain name forensics: a systematic approach to investigating an internet presence
US20020133572A1 (en) Apparatus and method for providing domain name services to mainframe resource mapping

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant