Achieving High-Availability DNS
Implementing Anycast with MikroTik OSPF and AdGuard Home
In high-availability infrastructure, DNS is a non-negotiable critical service. Conventional "Primary and Secondary" DNS configurations often suffer from client-side timeout issues. By leveraging Anycast via OSPF, we ensure that DNS failover is handled instantly by the router, providing a truly redundant and load-balanced experience.
I. The Evolution: Before vs After
Traditional Setup (Unicast)
Clients have two separate IPs. If Server 1 dies, the client "hangs" waiting for a timeout before trying Server 2. This causes perceptible delays.
Anycast Setup (OSPF)
Both servers share a "Magic IP" (.100). The MikroTik router sees two paths to the same IP. If one server fails, traffic is instantly rerouted.
II. Technical Terminology & Core Concepts
To understand how this high-availability system works, we must define its core components:
- OSPF (Open Shortest Path First): A dynamic routing protocol that allows routers and servers to share information about available paths. In this setup, AdGuard "advertises" its availability to the MikroTik router.
- Anycast: A network addressing method where a single IP address is shared by multiple endpoints. The router directs traffic to the best available path.
- FRR (Free Range Routing): An open-source routing suite for Linux that enables our AdGuard Containers (LXC) to communicate with the MikroTik router using OSPF.
III. Deep Dive: The Mechanics of FRR & OSPF Anycast
To master this setup, we must understand how FRR (Free Range Routing) transforms a standard DNS server into a network-aware node.
1. The Role of FRR
FRR is the engine that allows your Linux server to "speak" the language of routers. Instead of the MikroTik router manually checking if the server is up, the server uses FRR to announce its own existence. If the DNS service or the server itself fails, the announcement stops, and the router immediately knows the path is gone.
2. The Link-State Advertisement (LSA)
In OSPF, every node (AdGuard LXCs) acts as a neighbor to the MikroTik. Through FRR, the LXC sends an LSA. It tells the MikroTik: "I have a route to 192.168.88.100." Since both instances send the same advertisement, the MikroTik's Link-State Database sees two valid paths.
3. Understanding ECMP (Equal-Cost Multi-Path)
This triggers the + in DAo+. When OSPF finds multiple paths with the exact same cost and Administrative Distance (110), it uses ECMP to distribute traffic mathematically across all available healthy gateways.
4. The "Anycast" Illusion
The servers aren't "clustering" in the traditional sense. Instead, the Network is being gracefully manipulated. By assigning the IP to a loopback interface, the server accepts traffic for that IP locally, while FRR ensures the router knows where to send those packets.
5. Convergence and Health Checking
OSPF uses Hello Packets. If an AdGuard LXC freezes or FRR stops, the OSPF adjacency drops. The MikroTik immediately removes that path, redirecting all .100 traffic to the healthy node in seconds.
IV. Concept Architecture
The core of this setup is the "Magic IP"—a single IP address (192.168.88.100) shared by multiple instances. The MikroTik router uses OSPF to determine reachability and perform load balancing.
V. Server-Side Configuration (Linux LXC)
1. Assigning the Anycast Loopback IP
We use a loopback interface so the IP exists independently of the physical network card.
# Immediate Application:
ip addr add 192.168.88.100/32 dev lo
# Persistent Configuration: Edit /etc/network/interfaces
auto lo:1
iface lo:1 inet static
address 192.168.88.100
netmask 255.255.255.2552. AdGuard Home Listener Settings
AdGuard must listen on all interfaces to respond to the loopback IP.
- Open config:
nano /opt/AdGuardHome/AdGuardHome.yaml - Modify:
bind_host: 0.0.0.0 - Restart:
systemctl restart AdGuardHome
3. Dynamic Routing with OSPF (FRR)
We use FRR (Free Range Routing) to "advertise" our Anycast IP.
# 1. Install FRR
apt update && apt install frr -y
# 2. Enable OSPF: Edit /etc/frr/daemons and set 'ospfd=yes'
sed -i 's/ospfd=no/ospfd=yes/' /etc/frr/daemons
systemctl restart frr
# 3. Configure via vtysh
vtysh
conf t
router ospf
network 192.168.88.0/24 area 0
network 192.168.88.100/32 area 0
exit
wrVI. MikroTik Router Configuration
1. OSPF Interface Template
Navigate to Routing > OSPF > Interface Templates:
- Interfaces: Select the Bridge/VLAN where AdGuard resides.
- Area:
backbone(Area 0). - Network Type:
broadcast.
2. Verification: Decoding the MikroTik Route Status (DAo+)
Navigate to IP > Routes. You should see 192.168.88.100 with status DAo+. These flags are the primary indicators of a successful Anycast setup:
- D (Dynamic): The route was learned automatically via a protocol, not entered manually.
- A (Active): The route is currently valid and in use.
- o (OSPF): Confirms the route was learned through the OSPF protocol.
- + (ECMP - Equal-Cost Multi-Path): Indicates the router sees two or more equal paths to the same IP and is load-balancing traffic between them.
VII. Testing and Failover
The beauty of this setup is in its resilience:
- Shutdown Node 1: Observe MikroTik routes; the status changes from
DAo+toDAoas the path is withdrawn. - Client Experience: Zero interruption. The router instantly shifts traffic to the healthy node.
Comments
Post a Comment