Re: anyone generating location-specific tinydns values?

On Sat, Jan 2, 2010 at 12:03 PM, Alejandro Mery <[email protected]> wrote:
> Thanks to opendns and google's public resolver geodns became useless :(

Is it that bad? OpenDNS certainly tries to route your queries to your
nearest OpenDNS node, so I (in the UK) would be served by OpenDNS
resolvers in London. If I try connecting to Jason's service, he'd see
my query coming from a resolver in London and direct me to whatever
VPN node is most appropriate for London. Google seems less open with
details, but it looks like my queries there get handled in London as
well, or possibly Dublin; unless they're forwarding cache misses to
nodes elsewhere rather than resolving directly, I wouldn't expect
Google's DNS servers to cause a problem here. They do use similar
resolver tricks to route you to a nearby server themselves, so I would
be surprised if they configured their own DNS resolvers to break this!

Beyond Europe and North America, OpenDNS might be more of a problem:
someone in New Zealand using OpenDNS will be using a resolver on
another continent, which would be a problem *if* your servers have a
very different geographical distribution to OpenDNS or Google. In
Jason's case, that might well apply - I imagine he has an NZ presence,
while OpenDNS does not - but how many people choose to use a DNS
server on another continent like that?

I'd expect the geographically-aware DNS approach to work fairly well
with some exceptions, and set up a web page to try catching these by
checking the client machine's own IP address and the time zone and
locale settings from the browser against which server you've been
routed to. Alternatively, you could use vpn-username.example.com and
log "problem" cases to add exceptions - so if I, in the UK using
GoogleDNS somehow got routed to a US server the first time around, a
script could then add a special-case to make vpn-james.example.com
resolve to the UK server even when requested from a US resolver.
Probably not a huge programming task, a simple Perl script to trawl
the VPN node's logs and check for clients connecting to the "wrong"
node for their IP address. Probably a good sanity check for your geoIP
data, too; I recall one service which "intelligently" routed my
traffic to their server in Sweden rather than the US, not knowing that
the shorter straight-line distance wasn't reflected in available
network bandwidth.

I use a multi-location VPN service myself, which has a "smart"
hostname everyone can default to which usually routes people
correctly, but also provides regional hostnames (uk and us) and
specific ones (one for each node) so you can select a specific node
for any reason.


James.