Is there any limitations in using GeoIP with bind9

Question

I have a DNS server (BIND 9.10.3-P4-Ubuntu) on an Ubuntu 16.04 machine. I have a domain with two A records (IP1,IP2) which indicates to two separate web servers (Wserver1, Wserver2). I want the DNS server responds to the queries of country A from IP1 and the others from IP2. I have created a file named GeoIP.acl and included it in bind configurations and also added my A records to the related files of bind service.

named.conf:

    include "/etc/bind/named.conf.options";
    include "/etc/bind/named.conf.default-zones";
    include "/etc/bind/GeoIP-AA.acl";

named.conf.options:

    options {
        recursion no;
        // Put files that named is allowed to write in the data/ directory:
        directory                "/var/cache/bind";
        dnssec-validation auto;
        auth-nxdomain no;    # conform to RFC1035
        allow-query     { any; };
    };
logging {
        channel default_log {
                file "/var/log/named/named.log" versions 5 size 128M;
                print-time yes;
                print-severity yes;
                print-category yes;
                severity warning;
        };
        channel query_log {
                file "/var/log/named/query.log";
                severity debug 3;
                print-severity yes;
                print-time yes;
        };
        category queries { query_log; };
        category default { default_log; };
        category general { default_log; };
};

named.conf.default-zones

view "Country A" {
  match-clients { AA; };
  recursion no;
  additional-from-cache no;
zone "test.com" IN {
    type master;
    file "/var/cache/bind/test-AA.com.db";
    allow-update { none; };
    allow-query { any; };
    notify yes;
  };

view "Other" {
  match-clients { any; };
  recursion no;
  additional-from-cache no;

  zone "test.com" IN {
    type master;
    file "/var/cache/bind/test.com.db";
    allow-update { none; };
    allow-query { any; };
    notify yes;
  };

GeoIP-AA.acl:

acl "AA" {
        x1.x2.0.0/16;
        y1.y2.0.0/22;
        z1.z2.0.0/22;
        w1.w2.0.0/8;
};

test-AA.com.db has IP1 as A record and test.com.db has IP2 as A record. With these configurations I hope all clients from country A receives IP1 and other clients receives IP2 as the site IP address. It seems everything is working OK except that I saw some IP addresses in the logs which are redirected from wrong clients! I mean when I check the webserver logs of Wserver2 I can see some IPs which are in the GeoIP-AA.acl IP address ranges and received IP2 as the web site IP address. The file GeoIP-AA.acl has 6000 records. I wonder to know is there any limitations on using GeoIP ACLs with bind9? I think all IP address ranges are not checked in Bind or something else happens such as limitations in number of ACL records. Any help is appreciated

Answer 1

For me it seems your configuration is ok and following exactly e.g. the view clause example from Zytrax DNS BIND view Clause.

Don't focus on web server logs and stop comparing them to your ACL:

• The clients won't be using your authoritative name servers directly, but through their recursive name servers.
• Result for the queries are always cached for TTL seconds, so don't expect immediate results.

Instead, debug by adding more verbose logging to your BIND, namely for category queries.

logging {
    channel queries_file {
        file "/var/log/named/queries.log" versions 3 size 5m;
        severity debug 6;
        print-time yes;
        print-severity yes;
    };
    category queries { queries_file; };
}

If you see any of the queries falling to your ACL view, it's probably working. You could ensure this by randomly checking that queries matched to view "Other" don't have IP addresses matching your ACL and contrariwise. There's no documented limits for ACL size and no reason to believe so.

Currently (from comments) around 25% of your DNS queries falls into view "Country A", which seems very reasonable. You shouldn't think that statistics on DNS level has anything to do with the amount of actual web service clients, as the results are, again, cached for TTL. It's only natural that you get more DNS queries from countries where you have less clients, because the clients are divided among several ISPs, while a single country has less recursive DNS servers. Once a recursive DNS server has cached the record, many clients can be requesting for it during the TTL without additional request to your authoritative servers.