exentriquesolutions/nip.io

NIP.IO

Dead simple wildcard DNS for any IP Address.

NIP.IO is powered by PowerDNS with a simple, custom PipeBackend: backend.py

Head to NIP.IO for more details.

NIP.IO is licensed under Apache 2.0, and is a free service run by Exentrique Solutions

Environment Variables Configuration Overrides

While all configuration settings can be specified in a file called backend.conf, the following environment variables override those:

NIPIO_DOMAIN: NIP.IO main domain.

NIPIO_TTL: Default TTL for NIP.IO backend.

NIPIO_NONWILD_DEFAULT_IP: Default IP address for non-wildcard entries.

NIPIO_SOA_ID: SOA serial number.

NIPIO_SOA_HOSTMASTER: SOA hostmaster email address.

NIPIO_SOA_NS: SOA name server.

NIPIO_SOA_REFRESH: SOA refresh.

NIPIO_SOA_RETRY: SOA retry.

NIPIO_SOA_EXPIRY: SOA expiry.

NIPIO_SOA_MINIMUM_TTL: SOA minimum time-to-live (TTL).

NIPIO_NAMESERVERS: A space-separated list of domain=ip nameserver pairs. Example: ns1.nip.io=127.0.0.1 ns2.nip.io=127.0.0.1.

NIPIO_WHITELIST: A space-separated list of description=range pairs for whitelisted ranges in CIDR format. An IP address must be in one of the whitelisted ranges for a response to be returned. Example: whitelist1=192.168.0.0/16 whitelist2=127.0.0.0/8.

NIPIO_BLACKLIST: A space-separated list of description=ip blacklisted pairs. Example: some_description=10.0.0.1 other_description=10.0.0.2.

This is useful if you're creating your own Dockerfile.

Troubleshooting

• DNS Rebinding Protection

  Some DNS resolvers, forwarders and routers have DNS rebinding protection which may result in failure to resolve local and private IP addresses. This service won't work in those situations. However, you may run a local nip.io instance in this case.

Development

If you'd like to develop and hack with nip.io, then the easiest way is to install Poetry and then run ./build.sh which invokes Poetry. ./build.sh will run linting and tests as well.

nip.io's Issues

Deploy to k8s

Our k8s cluster does not have ipv6 and we receive the below error resulting in crashloopback.

Fatal error: Unable to acquire TCPv6 socket: Address family not supported by protocol

Is there a way to prevent this?

Add local.gd to "Related Services"

Firstly, many thanks for this service, especially because xip.io has shut down (even though I've been using yours since before that happened). It's an awesome service and one I use everyday.

I also had a similar idea and put up https://local.gd a few years ago. That service is (of course) more specific than yours but I find it's a bit easier to cover a few of the more simple use-cases.

If you'd like me to, I'd be happy to do a PR to add that to the end of the list of related services. No problem if not. And thanks again for your service ... as mentioned earlier, it's one I use everyday. :)

Add nip.io to public suffixes list

nip.io should be at the public suffixes list - https://publicsuffix.org/.

This is required mainly to solve issues with Let's Encrypt certificate issuance, but it'll help with Cookie Security in browsers as well.

I'd like you to be aware of this initiative and look for approval from your part.

Here's a relevant PR I created to the public suffix repo - publicsuffix/list#1070. Your assistance is required for DNS-level verification.

Some IP addresses don't work

Either this is something I don't entirely understand or it's a bug, but it happens on both xip and nip.

The domain 192-168-168-31.nip.io is not resolving to anything for me:

; <<>> DiG 9.10.6 <<>> 192-168-168-31.nip.io
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21764
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;192-168-168-31.nip.io.		IN	A

;; Query time: 26 msec
;; SERVER: 192.168.168.1#53(192.168.168.1)
;; WHEN: Wed Jul 29 15:04:07 CEST 2020
;; MSG SIZE  rcvd: 39

But the more traditional 192-168-0-31.nip.io does:

; <<>> DiG 9.10.6 <<>> 192-168-0-31.nip.io
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47161
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;192-168-0-31.nip.io.		IN	A

;; ANSWER SECTION:
192-168-0-31.nip.io.	86400	IN	A	192.168.0.31

;; Query time: 22 msec
;; SERVER: 192.168.168.1#53(192.168.168.1)
;; WHEN: Wed Jul 29 15:04:11 CEST 2020
;; MSG SIZE  rcvd: 64

Changing the 168 to 167 or 169 makes it resolve again. What is it about this subnet that breaks the DNS resolving?

Support DNS-01 challenges

sslip.io implemented support for DNS-01 challenges in cunnie/sslip.io#6, it would be nice if nip.io also supported them.

The core requirements are:

1. A query for _acme-challenge.$address.nip.io (no matter what record type in the question) should return a delegation for the address in the question, eg:

;; QUESTION SECTION:
;_acme-challenge.192-0-2-3.nip.io. IN	TXT

;; AUTHORITY SECTION:
_acme-challenge.192-0-2-3.nip.io. 604800 IN NS 192-0-2-3.nip.io.

;; ADDITIONAL SECTION:
192-0-2-3.nip.io.	604800	IN	A	192.0.2.3

2. A query for $address1.$address2.nip.io should return the address of address1 (not address2), i.e. the first address found should be returned (the deepest), eg:

;; QUESTION SECTION:
;192-0-2-7.192-0-2-3.nip.io. IN A

;; ANSWER SECTION:
192-0-2-7.192-0-2-3.nip.io. 604512 IN A 192.0.2.7

(for all examples above $address also includes the optional magic prefix).

My provider has DNS rebinding protection enabled - here's how I got a local instance working

I hope this may be helpful to someone. Thanks for an excellent service!

Why does nip.io not work in some networks?
Some networks block DNS rebinding. https://en.wikipedia.org/wiki/DNS_rebinding

Running a local nip.io instance

In some networks, nip.io does not work. In this case, run your own local nip.io service.

1. clone the nip.io repo

   $ git clone https://github.com/exentriquesolutions/nip.io 
   

2. set the ENV variables in Dockerfile, and run it

    # Dockerfile for nip.io
    ...
    COPY ...
    ENV NIPIO_DOMAIN=nip.io
    ENV NIPIO_NAMESERVERS=ns1.nip.io=127.0.0.52 ns2.nip.io=127.0.0.52
    ENV NIPIO_SOA_NS=ns1.nip.io
    CMD ...
   
    $ nohup ./build_and_run_docker.sh &
   

3. add the following to /etc/systemd/resolved.conf

   # Added for resolving nip.io DNS queries 
   [Resolve]
   DNS=127.0.0.52
   Domains=~nip.io
   

   The DNS= IP address must match the NIPIO_NAMESERVERS in the Dockerfile.
   This directs the host's DNS service to direct all queries for the nip.io
   domain to the DNS server running at this IP address (which is our
   nip.io instance). Reference: https://www.freedesktop.org/software/systemd/man/resolved.conf.html

4. restart systemd resolved

   $ sudo systemctl restart systemd-resolved.service
   

5. try dig

   $ dig foo-192.168.0.1.nip.io
   

   You should now get the 192.186.0.1 A record

DNS resolution quota

Hi, just a quick inquiry - is there a limit for amount of nip.io DNS resolutions per minute?

NS query support

Hello!
First of all, your software and service has been invaluable to me over the years, so thank you for that!

I wonder if we can add support for NS type queries. I think of it as an extra subdomain, like:

dig ns ns1.example.com.ns.nip.io +short
ns1.example.com.

What do you think?

Travis CI is not running

Travis CI no longer runs on travis-ci.org, you need to add it for travis-ci.com now instead.

Removed

I realized this is not how DNS works.

Is the nip.io service down?

Thank you!

IPv6 support

It would be nice if nip.io supported IPv6, eg a query with a type of AAAA for something like 2001-db8--1.nip.io would return a record of 2001:db8::1.

No IP for 192.168.0.0 block?

dig magic.192.168.86.201.nip.io

;; QUESTION SECTION:
;magic.192.168.86.201.nip.io. IN A

Is there a reason this does not work in the 192.168 IP block? This is my main usage for NIP.io :( but it doesnt work

Expired domain in config file

nip.io/nipio/backend.conf

Line 3 in db5bde0

domain=lcl.io

I don't have the time to investigate the impact of this issue, so it might be non-issue, but the domain "lcl.io" referenced in this file is for sale.

PowerDNS 4.4.0 and beyond

Starting PowerDNS 4.4.0, settings for default SOA values were removed:
https://doc.powerdns.com/authoritative/upgrading.html#removed-features

Now, handle_soa must return additional values: refresh, retry, expire and ttl

IP Range support

Hi.

It would be great to have something like 10.0.12.155-160.nip.io resolve to:

• 10.0.12.155
• 10.0.12.156
• 10.0.12.157
• 10.0.12.158
• 10.0.12.159
• 10.0.12.160

Better yet, besides ranges, a list like 10.0.12.155-10.0.12.161-10.0.12.163.nip.io which would resolve to:

• 10.0.12.155
• 10.0.12.161
• 10.0.12.163

That would be great for a poor man's load balancer.

Thansk for the great service!

DNS revolve failed. Record gone! The nip.io

several minutes ago all of my services failed to resolve the *.nip.io hosts, causing all of my servers down. Is there any accident report?

My DNS is 8.8.8.8 via my router

nip.io status

Hi,

I noticed the domain nip.io is not online for the last few days. Is this by error or has the service been stopped?

It's hard to find any information.

Thanks!

Allow CNAME support, not just "A" record

Use case: I have an internal machine in my private network with DNS: myvm.mycompany.com.

I need it to support wildcard subdomains, for example: db.admin.myvm.mycompany.com. This is useful when I use a reverse proxy or Kubernetes ingress controller, mapping host name to a service. From the host name it knows where to route the traffic. This is an elegant alternative to opening additional ports or using URL-prefix and URL-rewrite.

As long as the internal IP doesn't change, I can easily define service.10.10.1.1.nip.io and db.admin.10.10.1.1.nip.io. They both return the same IP, but in my reverse proxy or ingress controller, I can map them to different services, by the supplied host name HTTP header. (The usual web "virtual host" approach.)

The question is what to do if IP changes frequently, and it's beyond my control.

My suggested solution is to use part of nip.io DNS service as a service that only returns CNAME alias instead of "A" record with a static IP.

For example, I may use myvm.mycompany.com.cname.nip.io to get CNAME response pointing to myvm.mycompany.com. And db.admin-myvm.mycompany.com.cname.nip.io will also give CNAME response of myvm.mycompany.com. So if my company's IT staff changes the IP of the internal machine myvm, all URLs will stay valid, since they are just a CNAME reference to the real machine name.

Description seems wrong on the page

I saw the description below on the page, but it doesn't make any sense and seems wrong to me:

0a000803.nip.io maps to 116.203.255.68

As hex number, it suppose to be 10.0.8.3 , and a simple ping test confirmed it

⋊> ping 0a000803.nip.io
PING 0a000803.nip.io (10.0.8.3): 56 data bytes

xip.io no longer exists, the website still refers to it.

With xip.io no longer existing, it might make sense to remove the reference to it from the website.

ref: https://news.ycombinator.com/item?id=26991629

将127.0.0.1简写成1

www.7f000001.nip.io/www.127-0-0-1.nip.io/www.127.0.0.1.nip.io 能否简写成www.1.nip.io

Allow (or guide on configuring) binding to several DNS names

I want to resolve the AWS naming convention from my local machine. These addresses are in the format:

ip-192-0-2-1.ex-ampl-1.compute.internal

For example, ip-192-0-2-1.eu-west-1.compute.internal and ip-192-0-2-1.us-east-1.compute.internal

These both resolve to 192.0.2.1 (surprise! :) )

I have created my backend.conf for the region I mostly use (eu-west-1) as follows:

[main]
# main domain
domain=eu-west-1.compute.internal

# default ttl
ttl=432000

# default IP address for non-wildcard entries
ipaddress=127.0.0.1

# Indicates whether this response is authoritative, this is for DNSSEC.
auth=1

# Scopebits indicates how many bits from the subnet provided in the question.
bits=0

# SOA
[soa]
# serial number
id=1
# Hostmaster email address
[email protected]
# Name server
ns=ns1.compute.internal

# nameservers
[nameservers]
ns1.nip.io.example=127.0.0.1
ns2.nip.io.example=127.0.0.1

I've then configured dnsmasq on my network to forward eu-west-1.compute.internal to the docker container running this software, but I'd love to have it either respond to multiple domain names (e.g. ip-192-0-2-1.eu-west-1.compute.internal and ip-192-0-2-1.us-west-1.compute.internal) or respond to any DNS name matching a regex (e.g. .*.compute.internal)

Any thoughts? Happy to try to cobble together some code, if that'd help :)

nip.io down?

Is the nip.io service down?

Wrong reply from service when trying to resolve a nonexistent IP

Hello,
there's an error while trying to resolve a wrong IP on purpose, using your hosted service (I'm not running it on-prem).
For example:

$ dig api.172.19.26.310.nip.io +short
116.203.255.68

it apparently happens with IP of both public and private networks.