一句话描述问题

H3C 的三层作为 DNS 的 proxy ，无法解析一些特定的域名，比如 home.console.aliyun.com

在三层上无法 ping 这个 ip ，但是直接向上游查询解析是 ok 的。

网络拓扑

PC:

192.168.0.100/24,gatway=192.168.0.50,vlan=20,access

H3C 三层：

1. vlan20 ip=192.168.0.50/24
2. vlan600 ip=10.0.0.50/24
3. 静态路由下一跳=10.0.0.60
4. dns 代理开启

dns proxy enable
dns server 10.0.0.60

1. dhcp server 开启

iKuai:

1. lan1=10.0.0.20/24
2. 静态路由:192.168.0.0/16 via 10.0.0.50 回程配置
3. dns 配置阿里云的 DoH(223.5.5.5)
4. 配置双击热备,VIP=10.0.0.60

在 pc 上的测试

正常域名：百度

dig baidu.com 正常

dig @192.168.0.50 baidu.com 正常 via 三层

dig @10.0.0.50 baidu.com 正常 via 三层

dig @10.0.0.20 baidu.com 正常 via 爱快

dig @10.0.0.60 baidu.com 正常 via 爱快 VIP

异常域名：home.console.aliyun.com

dig home.console.aliyun.com 不正常

dig @192.168.0.50 home.console.aliyun.com 不正常 via 三层

dig @10.0.0.50 home.console.aliyun.com 不正常 via 三层

dig @10.0.0.20 home.console.aliyun.com 正常 via 爱快

dig @10.0.0.60 home.console.aliyun.com 正常 via 爱快 VIP

在三层上 telnet 的测试

<H3C>ping baidu.com
Ping baidu.com (39.156.66.10): 56 data bytes, press CTRL_C to break
56 bytes from 39.156.66.10: icmp_seq=0 ttl=55 time=7.154 ms
56 bytes from 39.156.66.10: icmp_seq=1 ttl=55 time=6.585 ms
56 bytes from 39.156.66.10: icmp_seq=2 ttl=55 time=6.816 ms
56 bytes from 39.156.66.10: icmp_seq=3 ttl=55 time=6.693 ms
56 bytes from 39.156.66.10: icmp_seq=4 ttl=55 time=6.885 ms

--- Ping statistics for baidu.com ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 6.585/6.827/7.154/0.193 ms
<H3C>ping home.console.aliyun.com
ping: Unknown host.
<H3C>ping www.aliyun.com
Ping www.aliyun.com (111.62.160.100): 56 data bytes, press CTRL_C to break
56 bytes from 111.62.160.100: icmp_seq=0 ttl=55 time=16.770 ms
56 bytes from 111.62.160.100: icmp_seq=1 ttl=55 time=16.701 ms
56 bytes from 111.62.160.100: icmp_seq=2 ttl=55 time=17.034 ms
56 bytes from 111.62.160.100: icmp_seq=3 ttl=55 time=16.447 ms
56 bytes from 111.62.160.100: icmp_seq=4 ttl=55 time=17.285 ms

--- Ping statistics for www.aliyun.com ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 16.447/16.847/17.285/0.288 ms

www.aliyun.com 的 dns 解析和 home.console.aliyun.com 的解析的区别

root@port:/etc/nginx/sites-enabled# dig @10.0.0.60 home.console.aliyun.com
;; Warning: Client COOKIE mismatch

; <<>> DiG 9.18.12-0ubuntu0.22.04.3-Ubuntu <<>> @10.0.0.60 home.console.aliyun.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3431
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 83b36405866ca8bc (bad)
;; QUESTION SECTION:
;home.console.aliyun.com.       IN      A

;; ANSWER SECTION:
home.console.aliyun.com. 37     IN      CNAME   one-console-adns.console.aliyun.com.
one-console-adns.console.aliyun.com. 37 IN CNAME one-console-adns.console.aliyun.com.gds.alibabadns.com.
one-console-adns.console.aliyun.com.gds.alibabadns.com. 37 IN CNAME sh.wagbridge.aliyun.aliyun.com.
sh.wagbridge.aliyun.aliyun.com. 37 IN   CNAME   aliyun-adns.aliyun.com.
aliyun-adns.aliyun.com. 37      IN      CNAME   aliyun-adns.aliyun.com.gds.alibabadns.com.
aliyun-adns.aliyun.com.gds.alibabadns.com. 37 IN A 140.205.135.3

;; Query time: 0 msec
;; SERVER: 10.0.0.60#53(10.0.0.60) (UDP)
;; WHEN: Tue Dec 05 22:20:59 CST 2023
;; MSG SIZE  rcvd: 537

root@port:/etc/nginx/sites-enabled# dig @10.0.0.60 www.aliyun.com

; <<>> DiG 9.18.12-0ubuntu0.22.04.3-Ubuntu <<>> @10.0.0.60 www.aliyun.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50166
;; flags: qr rd ra; QUERY: 1, ANSWER: 19, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.aliyun.com.                        IN      A

;; ANSWER SECTION:
www.aliyun.com.         245     IN      CNAME   www-jp-de-intl-adns.aliyun.com.
www-jp-de-intl-adns.aliyun.com. 245 IN  CNAME   www-jp-de-intl-adns.aliyun.com.gds.alibabadns.com.
www-jp-de-intl-adns.aliyun.com.gds.alibabadns.com. 245 IN CNAME www.aliyun.com.w.cdngslb.com.
www.aliyun.com.w.cdngslb.com. 245 IN    A       111.32.210.193
www.aliyun.com.w.cdngslb.com. 245 IN    A       111.32.209.196
www.aliyun.com.w.cdngslb.com. 245 IN    A       111.32.209.192
www.aliyun.com.w.cdngslb.com. 245 IN    A       111.32.209.194
www.aliyun.com.w.cdngslb.com. 245 IN    A       111.32.209.197
www.aliyun.com.w.cdngslb.com. 245 IN    A       111.32.210.189
www.aliyun.com.w.cdngslb.com. 245 IN    A       111.32.210.188
www.aliyun.com.w.cdngslb.com. 245 IN    A       111.32.210.192
www.aliyun.com.w.cdngslb.com. 245 IN    A       111.62.160.96
www.aliyun.com.w.cdngslb.com. 245 IN    A       111.62.160.94
www.aliyun.com.w.cdngslb.com. 245 IN    A       111.62.160.98
www.aliyun.com.w.cdngslb.com. 245 IN    A       111.62.160.97
www.aliyun.com.w.cdngslb.com. 245 IN    A       111.62.160.95
www.aliyun.com.w.cdngslb.com. 245 IN    A       111.62.160.99
www.aliyun.com.w.cdngslb.com. 245 IN    A       111.62.160.93
www.aliyun.com.w.cdngslb.com. 245 IN    A       111.62.160.100

;; Query time: 0 msec
;; SERVER: 10.0.0.60#53(10.0.0.60) (UDP)
;; WHEN: Tue Dec 05 22:21:05 CST 2023
;; MSG SIZE  rcvd: 989

一些分析和猜测

1. 和爱快的 vip 无关，我试着把三层的 proxy ip 改为 10.0.0.20 ，问题依旧
2. 既然三层负责 dhcp ，理论上下发的 dns 地址也是三层的 vlanip 为好，虽然 dns 写爱快的 vip 能解决问题
3. 怀疑和 dns 解析结果有关系？比如包长什么的？