DNS DNS64 NAT64 El Capitan unbound

1. DNS64
OS X El Capitan(10.11.1)
and
unbound-1.5.1
2015/11/08
@otsuka752 (@twovs)

2. © 2015 Apple Inc. All rights reserved. Redistribution or public display not permitted without written permission from Apple.
#WWDC15
Your App and
Next Generation Networks
Prabhakar Lakhera Core OS Networking Engineer
Stuart Cheshire DEST
System Frameworks
Session 719
(抜粋)WWDC15 - Your App and Next Generation Network

3. IPv4 Server
Cellular Data Network
DNS64
NAT64
IPv6 Server
IPv6 Access
Connectivity
DNS64 synthesizes IPv6 address for IPv4 server
NAT64 performs IPv6 to IPv4 address translation
(抜粋)WWDC15 - Your App and Next Generation Network

4. NAT64 + DNS64 Internet Sharing
IPv4 WAN
IPv6 Access
Connectivity
DNS64
NAT64
(抜粋)WWDC15 - Your App and Next Generation Network

5. NAT64 + DNS64 Internet Sharing
IPv4 WAN
IPv6 Access
Connectivity
DNS64
NAT64
触ってみた

6. NAT64/DNS64 の準備
6

7. NAT64/DNS64 の準備
optionを
押しながら
クリック
7

8. 上位回線を指定
IPv4だけでOK
下位回線は
IPv6だけが
構成される
NAT64/DNS64 の準備
8

9. bridge100
2001:2:0:aab1::0/64
【参考】https://www.nic.ad.jp/ja/mailmagazine/backnumber/2015/vol1335.html

10. unbound ?
dns64-synthall: yes
synthesize all AAAA records despite the
presence of actual AAAA records.
El Capitan 自身に設定された
DNS Cache サーバのアドレス
10

11. unbound-1.5.1 ?
11

12. • ipv4only.example.jp.
→ A だけある(AAAA は無い)
• ipv4v6.example.jp.
→ A も AAAA もある
• ipv6only.example.jp.
→ AAAA だけある(A は無い)
12
以下の AAAA を問い合わせてみる

13. NAT64 + DNS64 Internet Sharing
IPv4 WAN
IPv6 Access
Connectivity
DNS64
NAT64
(抜粋)WWDC15 - Your App and Next Generation Network
xxx.example.jp.
AAAA?

14. dns64-
synthall:
qname answer
yes
ipv4only 64:ff9b::xx:xx
ipv4andv6 64:ff9b::xx:xx
ipv6only (none)
B yes ::/0
ipv4only 64:ff9b::xx:xx
ipv4andv6 64:ff9b::xx:xx
ipv6only (none)
C no (none)
ipv4only 64:ff9b::xx:xx
ipv4andv6 (global unicast addr)
ipv6only (global unicast addr)
D no ::/0
ipv4only 64:ff9b::xx:xx
ipv4andv6 64:ff9b::xx:xx
ipv6only (none)
El Capitan の結果
AAAA があっても
A をマップした 64:ff9b::xx:xx を応答
つまり、A が 192.0.2.1 の場合は
64:ff9b::c000:201
14

15. NAT64 + DNS64 Internet Sharing
IPv4 WAN
IPv6 Access
Connectivity
DNS64
NAT64unbound-1.5.1
dns64-synthall: yes¦no
private-address: (none)¦::/0
xxx.example.jp.
AAAA?

16. dns64-
synthall:
private-
address:
qname answer
A yes (none)
ipv4only 64:ff9b::xx:xx
ipv4andv6 64:ff9b::xx:xx
ipv6only (none)
B yes ::/0
ipv4only 64:ff9b::xx:xx
ipv4andv6 64:ff9b::xx:xx
ipv6only (none)
C no (none)
ipv4only 64:ff9b::xx:xx
ipv4andv6 (global unicast addr)
ipv6only (global unicast addr)
D no ::/0
ipv4only 64:ff9b::xx:xx
ipv4andv6 64:ff9b::xx:xx
ipv6only (none)
unbound-1.5.1 の結果
El
Capitan
と同じ

17. • dns64-synthall: yes されているように見え
AAAA があっても A を 64:ff9b::xx:xx にマップ
• そもそも上位に AAAA を問い合わせていない
• unbound-1.5.1 が動いているように見える
17
まとめ/El Capitan の DNS64

18. • dns64-synthall: yes されていると AAAA を名前
解決しようとせず、いきなり A を問い合わせる
• private-address: ::/0 を指定していても DNS64
の 64:ff9b::xx:xx は返答する
18
まとめ/unbound-1.5.1 の DNS64

19. 参考/上位への問い合わせ(unbound)
dns64-
synthall:
private-
address:
qname query to uplink
A yes (none)
ipv4only A only
ipv4andv6 A only
ipv6only A only
B yes ::/0
ipv4only A only
ipv4andv6 A only
ipv6only A only
C no (none)
ipv4only AAAA + A
ipv4andv6 AAAA only
ipv6only AAAA only
D no ::/0
ipv4only AAAA + A
ipv4andv6 AAAA + A
ipv6only AAAA + A

20. END