Search Results for ddns 简单

20分钟搭建一个自用的DDNS服务

08年的时候，在学校，花了点时间做了个ddns服务，不知道现在是否还活着，ddns.bitunion.org。当时的方案，powerdns + mysql + php ui，php ui是自己做的，简单地做了个校内邮箱的校验，使用了个简单的token机制来更新记录。这回，有个需求是需要做一个ttl < 10的ddns服务，之前所有域名都在dns.he.net上，最小ttl限制到了300，这样以来，更新的延迟特定场景下不够用。自用DDNS的需求里，域名不会被广泛知晓并使用，否则NS服务器的压力会是个问题。方案还是一样，powerdns + mysql，写了个最简单的http接口页面给ddclient用。服务器是 ubuntu 17.04，公网IP 1.2.3.4. 目标域名 xxx.ddns.sskaje.me 安装软件按下列命令安装必备软件，全默认

apt install  pdns-server pdns-tools pdns-backend-mysql

1	apt install pdns-server pdns-tools pdns-backend-mysql

配置powerdns 考虑到现在的linux服务器，本地53端口经常被占用，所以需要修改 /etc/powerdns/pdns.conf，指定监听的IP

local-address=1.2.3.4

1	local-address=1.2.3.4

配置zone和records 在sskaje.me的域名服务器上，添加NS记录 ddns.sskaje.me，指向IP 1.2.3.4。考虑到未来可能改IP，可以加一个A记录 ddns1.sskaje.me，指向 1.2.3.4，这样ddns.sskaje.me的NS设置成 ddns1.sskaje.me。创建zone

# pdnsutil create-zone ddns.sskaje.me
Jul 16 08:59:55 [bindbackend] Done parsing domains, 0 rejected, 0 new, 0 removed
Creating empty zone 'ddns.sskaje.me'

# pdnsutil create-zone ddns.sskaje.me

Jul 16 08:59:55 [bindbackend] Done parsing domains, 0 rejected, 0 new, 0 removed

Creating empty zone 'ddns.sskaje.me'

更正SOA记录

# pdnsutil add-record ddns.sskaje.me @  SOA 2592000 "dns.sskaje.me. dns.sskaje.me. 1 10800 3600 604800 3600"
Jul 16 09:13:47 [bindbackend] Done parsing domains, 0 rejected, 0 new, 0 removed
New rrset:
ddns.sskaje.me. IN SOA 3600 a.misconfigured.powerdns.server hostmaster.ddns.sskaje.me 1 10800 3600 604800 3600
ddns.sskaje.me. IN SOA 2592000 dns.sskaje.me dns.sskaje.me 1 10800 3600 604800 3600

# pdnsutil add-record ddns.sskaje.me @ SOA 2592000 "dns.sskaje.me. dns.sskaje.me. 1 10800 3600 604800 3600"

Jul 16 09:13:47 [bindbackend] Done parsing domains, 0 rejected, 0 new, 0 removed

New rrset:

ddns.sskaje.me. IN SOA 3600 a.misconfigured.powerdns.server hostmaster.ddns.sskaje.me 1 10800 3600 604800 3600

ddns.sskaje.me. IN SOA 2592000 dns.sskaje.me dns.sskaje.me 1 10800 3600 604800 3600

添加 xxx.ddns.sskaje.me，设置ttl=10

# pdnsutil add-record ddns.sskaje.me xxx A 10 127.0.0.1
Jul 16 09:14:55 [bindbackend] Done parsing domains, 0 rejected, 0 new, 0 removed
New rrset:
xxx.ddns.sskaje.me. IN A 10 127.0.0.1

# pdnsutil add-record ddns.sskaje.me xxx A 10 127.0.0.1

Jul 16 09:14:55 [bindbackend] Done parsing domains, 0 rejected, 0 new, 0 removed

New rrset:

xxx.ddns.sskaje.me. IN A 10 127.0.0.1

简单的更新脚本 DynDNS的更新接口参数类似：

/nic/update?system=dyndns&hostname=xxx.ddns.sskaje.me&myip=4.3.2.1

1	/nic/update?system=dyndns&hostname=xxx.ddns.sskaje.me&myip=4.3.2.1

认证使用 http basic auth 完成的。所以一个简单的服务端脚本

<?php

$auth = [
    'xxx.ddns.sskaje.me' =>  'This.15.p4ssw0rd',
];


if (!isset($_SERVER['PHP_AUTH_USER']) || !isset($_SERVER['PHP_AUTH_PW'])) {
    die('badauth');
}

if (!isset($auth[$_SERVER['PHP_AUTH_USER']])) {
    die('badauth');
}

if ($auth[$_SERVER['PHP_AUTH_USER']] != $_SERVER['PHP_AUTH_PW']) {
    die('badauth');
}

if (!isset($_GET['hostname'])) {
    die('badauth');
}

if ($_GET['hostname'] != $_SERVER['PHP_AUTH_USER']) {
    die('badauth');
}

$db = new mysqli('localhost', 'root', '123123123', 'pdns');
$db->set_charset('utf8');
try {
    $db->autocommit(0);

    $result = $db->query("SELECT * FROM records WHERE name='{$_SERVER['PHP_AUTH_USER']}' FOR UPDATE ");

    if (!$result->num_rows) {
        throw new Exception('nohost');
    }

    $record = $result->fetch_assoc();
    if ($record['type'] != 'A') {
        throw new Exception('nohost');
    }

    if (!isset($_GET['myip'])) {
        $ip = get_client_ip();
    } else {
        $ip = long2ip(ip2long($_GET['myip']));
    }

    if ($ip == $record['content']) {
        throw new Exception('nochg');
    }

    $db->query("UPDATE records SET content='{$ip}' WHERE id={$record['id']}");

    $db->commit();

    echo "good {$ip}\n";

} catch (Exception $e) {
    $db->rollback();

    echo $e->getMessage() . "\n";
} finally {
    $db->close();
}

function get_client_ip()
{
    if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
        return $_SERVER['HTTP_CF_CONNECTING_IP'];
    }

    return $_SERVER['REMOTE_ADDR'];
}

<?php

$auth = [

'xxx.ddns.sskaje.me' => 'This.15.p4ssw0rd',

];

if (!isset($_SERVER['PHP_AUTH_USER']) || !isset($_SERVER['PHP_AUTH_PW'])) {

die('badauth');

}

if (!isset($auth[$_SERVER['PHP_AUTH_USER']])) {

die('badauth');

}

if ($auth[$_SERVER['PHP_AUTH_USER']] != $_SERVER['PHP_AUTH_PW']) {

die('badauth');

}

if (!isset($_GET['hostname'])) {

die('badauth');

}

if ($_GET['hostname'] != $_SERVER['PHP_AUTH_USER']) {

die('badauth');

}

$db = new mysqli('localhost', 'root', '123123123', 'pdns');

$db->set_charset('utf8');

try {

$db->autocommit(0);

$result = $db->query("SELECT * FROM records WHERE name='{$_SERVER['PHP_AUTH_USER']}' FOR UPDATE ");

if (!$result->num_rows) {

throw new Exception('nohost');

}

$record = $result->fetch_assoc();

if ($record['type'] != 'A') {

throw new Exception('nohost');

}

if (!isset($_GET['myip'])) {

$ip = get_client_ip();

} else {

$ip = long2ip(ip2long($_GET['myip']));

}

if ($ip == $record['content']) {

throw new Exception('nochg');

}

$db->query("UPDATE records SET content='{$ip}' WHERE id={$record['id']}");

$db->commit();

echo "good {$ip}\n";

} catch (Exception $e) {

$db->rollback();

echo $e->getMessage() . "\n";

} finally {

$db->close();

}

function get_client_ip()

{

if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {

return $_SERVER['HTTP_CF_CONNECTING_IP'];

}

return $_SERVER['REMOTE_ADDR'];

}

Incoming search terms:自建DDNS搭建DDNS自己搭建ddnsddns搭建DDNS服务搭建DDNS服务pdnsutil … Continue reading “20分钟搭建一个自用的DDNS服务”

Azure Site-to-Site VPN with Dynamic Client IP

以前自己用 strongswan 等软件配 IPSec site-to-site 的时候，可以直接指定客户端的 IP 是 0.0.0.0，Azure 的 site-to-site IPSec VPN 必须要指定客户端 IP。 PowerShell 爱好者可以参考 https://www.hayesjupe.com/using-azure-rm-site-to-site-vpn-with-a-dynamic-ip/ 这篇文章。我还是习惯用 Linux，于是使用 Azure CLI 来解决这个问题。在 VPN 的 Virtual Network 里放置一台 Linux 虚拟机。按照上述连接里的说明安装软件。接下来开始操作。 1 登录 SSH 登录虚拟机后，执行命令，并按照输出，用浏览器登录 Azure 账号，完成认证。

$ az login
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code XXXXXXX to authenticate.

1 2	$ az login To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code XXXXXXX to authenticate.

如果是中国区 Azure，先需要设置服务器

$ az cloud set -n AzureChinaCloud
Switched active cloud to 'AzureChinaCloud'.
Use 'az login' to log in to this cloud.
Use 'az account set' to set the active subscription.

$ az cloud set -n AzureChinaCloud

Switched active cloud to 'AzureChinaCloud'.

Use 'az login' to log in to this cloud.

Use 'az account set' to set the active subscription.

如果需要切换回海外版本

$ az cloud set -n AzureCloud

1	$ az cloud set -n AzureCloud

2 添加更新服务参考 DDNS 的玩法，让客户端定期更新IP。服务端可以简单地将数据记录到数据库、文件、或者任何地方，配置一个 cron 来执行更新检测和 Gateway IP 更新。 3 … Continue reading “Azure Site-to-Site VPN with Dynamic Client IP”

抛开路由为局域网内机器启用IPv6

支持IPv6这事情不一定非得要路由上配，局域网内只要有Linux机器能用IPv6就行。这种事情做之前，对于完全不会的人和会的人都很简单，但对我这种稍微懂一点的，还没做可能就先想多了。测试环境公司路由：TP-Link某老旧企业路由，不支持IPv6 Linux：Debian Jessie, 服务主机，兼顾dns，dhcp等等服务，LAN接口eth0 网络：北京联通家庭光纤 PPPoE IPv6 服务：Tunnel Broker 其他软件：dnsmasq, dhcpd Incoming search terms:wireguard设置ipv6 dhcp-baijiahaoaccept7cnanybodyrx3LAN怎么成为IPv6stoodwx7企业路由ipv6局域网IPV6开启 RADVD维盟路由器 ipv6Link to this post!

TunnelBroker for EdgeRouter Lite

创建隧道在北京联通这种不给IPv6网络的ISP下生存，总有走v6翻墙的欲望。免费的Tunnel服务很多，最出名莫过HE.net的TunnelBroker 首先申请一个Tunnel。访问：

https://tunnelbroker.net/new_tunnel.php

1	https://tunnelbroker.net/new_tunnel.php

注册登录之后，创建并输入当前路由公网IP “YOUR.ROUTER.INTERNET.IP”。创建成功后会被跳转到

https://tunnelbroker.net/tunnel_detail.php?tid=XXXXX

1	https://tunnelbroker.net/tunnel_detail.php?tid=XXXXX

XXXXX的部分是一串数字，所谓的Tunnel ID. 在这个页面上选择第二个标签页 “Example Configurations” 选择 “Vyatta / Ubiquiti EdgeMAX” 文本框会自动生成如下配置：

configure
edit interfaces tunnel tun0
set encapsulation sit
set local-ip YOUR.ROUTER.INTERNET.IP
set remote-ip 74.82.46.6
set address 2001:470:23:XXXX::XX/64
set description "HE.NET IPv6 Tunnel"
exit
set protocols static interface-route6 ::/0 next-hop-interface tun0
commit

configure

edit interfaces tunnel tun0

set encapsulation sit

set local-ip YOUR.ROUTER.INTERNET.IP

set remote-ip 74.82.46.6

set address 2001:470:23:XXXX::XX/64

set description "HE.NET IPv6 Tunnel"

exit

set protocols static interface-route6 ::/0 next-hop-interface tun0

commit

remote-ip是创建时选择的远端服务器IP，local-ip是本地当前的出口IP。鉴于ISP给的IP都是动态的，所以local-ip改成如下‘0.0.0.0’。如果之前有配置过tunnel，需要重新配置，则先删除既有的：

delete interfaces tunnel tun0

1	delete interfaces tunnel tun0

下面开始命令配置tunnel

configure
# tun to ipv6
edit interfaces tunnel tun0
set encapsulation sit
set local-ip 0.0.0.0
set remote-ip 74.82.46.6
set address 2001:470:23:XXXX::XX/64
set description "HE.NET IPv6 Tunnel"
exit
set protocols static interface-route6 ::/0 next-hop-interface tun0
commit
save

configure

# tun to ipv6

edit interfaces tunnel tun0

set encapsulation sit

set local-ip 0.0.0.0

set remote-ip 74.82.46.6

set address 2001:470:23:XXXX::XX/64

set description "HE.NET IPv6 Tunnel"

exit

set protocols static interface-route6 ::/0 next-hop-interface tun0

commit

save

Router Advert 配置完tunnel，就得配局域网内的配置了，毕竟只有路由能上v6是不够的

interfaces {
    ethernet eth0 {               
        address 192.168.11.1/24   
        duplex auto               
        ipv6 {                    
            address {             
                autoconf           
            }                     
            dup-addr-detect-transmits 1
            router-advert {                        
                cur-hop-limit 64  
                link-mtu 0        
                managed-flag false
                max-interval 600  
                other-config-flag false
                prefix 2001:470:24:xxx::/64 {
                    autonomous-flag true
                    on-link-flag true       
                    valid-lifetime 2592000         
                }                 
                radvd-options "RDNSS 2001:470:20::2  {} ;"
                reachable-time 0  
                retrans-timer 0   
                send-advert true  
            }                     
        }                         
        speed auto                          
    } 
...
}

interfaces {

ethernet eth0 {

address 192.168.11.1/24

duplex auto

ipv6 {

address {

autoconf

}

dup-addr-detect-transmits 1

router-advert {

cur-hop-limit 64

link-mtu 0

managed-flag false

max-interval 600

other-config-flag false

prefix 2001:470:24:xxx::/64 {

autonomous-flag true

on-link-flag true

valid-lifetime 2592000

}

radvd-options "RDNSS 2001:470:20::2 {} ;"

reachable-time 0

retrans-timer 0

send-advert true

}

speed auto

}

...

}

如果你本地的DNS规则有过配置，radvd-options 的配置一定要把ipv6地址设成路由器的v6地址实践证明，我之前折腾了好久的dhcpv6没用，但是配置也可以贴出来

...
service { 
...                     
    dhcpv6-server {                              
        shared-network-name LAN_DEAD {   
            name-server 2001:4860:4860::8888
            name-server 2001:4860:4860::8844 
            subnet 2001:470:23:xxxx:dead::/80 {   
                address-range {         
                    start 2001:470:23:xxxx:dead::1000 {
                        stop 2001:470:23:xxxx:dead::8000
                    }                            
                }                       
                name-server 2001:4860:4860::8888 
                name-server 2001:4860:4860::8844
                prefix-delegation {              
                    start 2001:470:23:xxxx:dead::1000 {
                        prefix-length 80
                    }                  
                }                          
            }                           
        }                               
    }  
}

...

service {

...

dhcpv6-server {

shared-network-name LAN_DEAD {

name-server 2001:4860:4860::8888

name-server 2001:4860:4860::8844

subnet 2001:470:23:xxxx:dead::/80 {

address-range {

start 2001:470:23:xxxx:dead::1000 {

stop 2001:470:23:xxxx:dead::8000

}

name-server 2001:4860:4860::8888

name-server 2001:4860:4860::8844

prefix-delegation {

start 2001:470:23:xxxx:dead::1000 {

prefix-length 80

}

自动更新IP 之前一片EdgeRouter Lite相关的配置文章里，我把He.net提供的DDNS配置好了。Dynamic DNS on HE.net, HE.net Dynamic DNS on Ubiquiti Router. 脚本更新首先按如下路径生成ddns专用的key

TunnelBroker.net -> Tunnel Details -> Advanced -> Update Key

1	TunnelBroker.net -> Tunnel Details -> Advanced -> Update Key

尝试过好多次，EdgeRouter Lite无法通过配置参数添加多个同类型的ddns配置。所以先提供一个简单粗暴的方法。参考 https://forums.he.net/index.php?topic=1994.0 的说明，有如下的客户端语法： … Continue reading “TunnelBroker for EdgeRouter Lite”