An advanced systems administration and networking series covering network bonding, firewalling, DNS resolution, enterprise storage, web services, and security hardening.
The previous chapter established the concepts: VXLAN encapsulates Layer 2 frames inside UDP/IP packets, extends the identifier space to 24 bits, and allows a Layer 2 segment to span a Layer 3 underlay. This chapter is the configuration sequence. It covers the ip link commands that create a VXLAN interface, the two peer-discovery models (unicast…
Generic Routing Encapsulation (GRE) is a tunneling protocol that wraps one network-layer protocol inside another. In its most common Linux configuration, GRE encapsulates IPv4 or IPv6 packets inside an outer IPv4 packet, creating a point-to-point virtual link between two routers across an IP underlay . The Linux kernel implements GRE as a virtual network interface,…
IPIP (IP-in-IP) is the simplest tunnel protocol the Linux kernel supports. It encapsulates an IPv4 packet inside another IPv4 packet, adding exactly one outer IP header and nothing else. There is no GRE header, no UDP header, and no key field. The result is the lowest overhead of any IP tunnel: 20 bytes on a…
BIND9 is the reference implementation of the Domain Name System protocol on Linux, and its daemon named is the software that answers DNS queries. It is not a single-purpose tool with one fixed behavior. A BIND9 instance can be an authoritative name server for zones you control, a recursive resolver that looks up names on…
BIND9 is packaged for every major Linux distribution, and installation is a single package manager command. The complexity begins after the packages are installed. The default configuration shipped by Debian and RHEL is not a blank slate; it includes preconfigured zones, default options, and service management hooks that differ between distributions. An administrator who edits…
A BIND9 zone file is the authoritative data source for a domain. It is a plain text file that declares the domain’s name servers, its mail exchangers, its host addresses, and the start-of-authority record that ties the whole zone together. The previous chapter configured the server to load a zone; this chapter explains what goes…
Forwarding and recursion are two mechanisms BIND9 uses to resolve names it is not authoritative for. Recursion is the iterative process: the server starts at the root, follows referrals down the hierarchy, and caches the result. Forwarding is a shortcut: the server sends the query to an upstream resolver and waits for the answer, instead…
A reverse zone maps IP addresses back to hostnames. It is the mirror image of the forward zone: where the forward zone answers “what is the address for this name?” the reverse zone answers “what is the name for this address?” The data lives in a separate zone with a special name derived from the…
dnsmasq is a lightweight DNS forwarder and DHCP server designed for small networks. It is not a replacement for BIND9’s authoritative zone hosting; it is a different tool with a different purpose. dnsmasq forwards DNS queries to upstream resolvers, caches the responses, and serves local names from /etc/hosts and DHCP leases. It also provides DHCP,…
Unbound is a validating, recursive, and caching DNS resolver. It is not an authoritative server like BIND9, and it is not a combined forwarder/DHCP daemon like dnsmasq. It performs one function and performs it thoroughly: it takes a query from a client, walks the DNS hierarchy from the root down using its built-in root hints,…