search

desec-io / desec-stack

Backbone of the deSEC Free Secure DNS Hosting Service
https://desec.io/
MIT License
380 stars 48 forks source link

Add subdomains with dynamic subnets to *.dedyn.io domains #13

Open peterthomassen opened 7 years ago

peterthomassen commented 7 years ago

Currently, users can update there IPv4 and IPv6 addresses for their domain.dedyn.io. IPv6 users, however, often control a dynamic subnet and may want to run services on various IP addresses within this subnet.

It would be nice to allow users to create subdomains with static "local IP bits", only updating the subnet through our update mechanism. The user would have to specify the subnet size (e.g. /80), and upon IP update, only the first 80 bits of the AAAA records would be updated.

nils-wisiol commented 7 years ago

moved to #46

peterthomassen commented 7 years ago

@nils-wisiol that was premature ;-)

JeGr commented 1 year ago

Ah sorry I didn't realize that my FR was already open in such an early ticket.

I'm afraid I'm not that good in writing new code so I'm absolutely open to help but would not know how besides of writing code. I could be able to collect some sponsoring of that though so I'll have a look what I can bring up.

peterthomassen commented 1 year ago

no prob. Feel free to get in touch via email if needed!

JeGr commented 1 year ago

Would putting up a bounty for that feature bring it up? If so I'd try to get some funds together :)

peterthomassen commented 1 year ago

I think we can find a way. Please shoot us an email to discuss further!

noltedennis commented 1 year ago

I'd be interested into this feature as well.

The one thing that is a big question mark to me still is how one would do the scoping. From what I've seen with my (limited) usage experience of deSEC, the only available "container" elements so far are domains. Requiring all AAAA entries in a domain to share the same IPv6 prefix seems a bit off to me. Should there be an alternative container element that groups multiple AAAA records?

renne commented 8 months ago

I suggest a new entity "ipv6prefix" with a webui table per IPv6 prefix following the structure:

Subdomain IPv4 IPv6 EUI-64/Interface Identifier
host1.domain1.tld [x] [x] ::1
host2.domain3.tld [ ] [x] ::2
host3.domain7.tld [x] [ ] ::3
host4.domain2.tld [x] [x] ::4
host5.domain4.tld [x] [x] ::5
host6.domain8.tld [x] [x] ::6
host7.domain6.tld [ ] [x] ::7
host8.domain9.tld [x] [x] ::8
hostN.domainN.tld [x] [x] ::N

That way e.g. a Fritz!Box router can update all subdomains with the single DNAT IPv4 address and subdomain-specific IPv6 addresses. The current situation of multiple updates is error-prone and will put a lot of stress on the DNS servers in case a lot of users start self-hosting with IPv6 at home.