使用F5 irules 完成nxdomain redirect
前提：
1、有F5 LTM
2、DNS負載並不是很高或者F5性能很好比如V10平台
原理：
DNS用於響應的報文由12位元組長的首部和4個長度可變的欄位組成。其中從第28位開始的4位的標誌欄位的子欄位為rcode為返回碼欄位，通常的值為0（沒有差錯）和3（名字差錯），名字差錯從一個授權的名字伺服器上返回，表示在查詢中指定的域名不存在。
因此把rcode欄位返回的值變更為指定的字元串，就可以完成nxdomain redirect的要求
iRules 是基於事件的策略，以流行的 TCL 腳本語言為基礎，可幫助用戶充分利用 F5 解決方案的強大能力和靈活性，進而從應用交付網路中獲取最大利益（實際上就是拆包重組的過程中加入控制）
分析和腳本：（參看後文和附件），另外該腳本的作者明確說了，這種做法是違反rfc的，而且會影響antispam的blacklist技術的使用，也許還會影響對域名的判斷情況，應該慎重使用。
腳本測試沒有問題，在f5部署上，需要在vs中首先應用udp類型的profile，然後將該irules加入指定的vs就ok了
《解決方案》
回復 #1 kor 的帖子
DNS_no_more_non_existent_domain
.
Contributed by: Yang MingFei (James Yang)
Modified by: Nat
Description
With this rules, BIGIP can convert a 「non-exist domain」 DNS query result to a "normal" response to client. That will help if client type the wrong domain name (ie. if a client types "wwww.f5.com" for www.f5.com, when the request send to a load balanced DNS cache server, it will return an error message of non-exist domain (NXDOMAIN), then the plugin of browser will redirect it to an search engine or other site. After apply this rules to the BIGIP that load balances the DNS cache servers, BIGIP will replace the Cache DNS』s error message and turn it to a specified IP address like "wwww.f5.com=200.100.4.10" in the sample rule. That the 200.100.4.10 may be portal of the service provider. Or a friendly error page that indicate the type error.
NoteRewriting non-existent domain DNS responses can introduce serious security issues for any domain which is resolved in such a manner. It may also break SPAM blacklisting. For more information, see http://www.wired.com/threatlevel/2008/04/isps-error-page/
iRule Source
when RULE_INIT {
set ::my_address {200 100 4 10}
#Addr: 200.100.4.10, you can modify your own IP address here
set ::header_without_id
#predefined fixed header
# 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
# | ID |
# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
# |QR| Opcode |AA|TC|RD|RA| Z | RCODE |
# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
# | QDCOUNT |
# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
# | ANCOUNT |
# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
# | NSCOUNT |
# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
# | ARCOUNT |
# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
#
#opcode = QUERY, rcode = NOERROR
#header flags: response, auth. answer, want recursion, recursion avail.
#questions = 1, answers = 1, authority records = 0, additional = 0
set ::answerpart
#predefined Fixed Answer section
#Name: same as qestion
#Type: Host address
#Class: INET
#Time to live: 55 minutes, 55seconds
#Data length: 4
#IPv4 Addr: xxx.xxx.xxx.xxx
#Data Structure
# 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
# | Name |
# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
# | Answer Type |
# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
# | Class |
# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
# | Time to live part 1 |
# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
# | Time to live part 2 |
# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
# | IP Address part 1 |
# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
# | IP Address part 2 |
# +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
}
when SERVER_DATA {
#check rcode
binary scan @2S sflags
set rcode
#rcode = 3 Name Error (domain name referenced in the query does not exist.
if {$rcode == 3 }{
# skip the DNS header, jump to the QNAME part of first QUESTION
# byte contains the first part length
binary scan @12c foo
# make the byte an unsigned integer
set byte
# initialize our posisition in the QNAME parsing and the text QNAME
set offset 12
# $i is a sanity check so this logic won't spin on invalid QNAMEs
set i 0
############# /extract QNAME from QUESTION header #############
while {$byte > 0 && $i < 10} {
# grab a part and put it in our text QNAME section
set offset
# grab the length of the next part, and make it an unsigned integer
binary scan @${offset}c foo
set byte
incr i
}
# increment offset past the final part so it points at the QTYPE field
incr offset
############# extract QTYPE from QUESTION header #############
# grab the next 2 bytes that represent the QTYPE
binary scan @${offset}S qtype
# see if the QTYPE is 0x0001 (TYPE_AAAA), if it's a A query, then replace the content
if {$qtype == 0x0001} {
#Pack the respond packet
#keep original query id
#replace header with predefined header without id (answer part and remove NS/AR part
#replace the rest of packet after query section with predefined answer section
UDP::payload replace 2 10 $::header_without_id
incr offset 4
UDP::payload replace $offset - $offset ] $::answerpart
}
}
}
《解決方案》
謝謝樓主。好東西，收藏。樓主知道有什麼軟體方式做負載均衡的好辦法沒？
