<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks for your reply. Regarding versioning, while I would like to be on the most current version, I don't want to build from source and that leaves me relying on my distro (CentOS 7.6 is where I put my stake in the ground, at present) package manager's version
which is presently 9.11.4-9.P2. I assume someone is backporting critical patches as I'm not getting complaints from a credentialed OpenVAS scan, but I appreciate your caution about the version I'm using and MaxMind GeoIP.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
You also make a good point about the delta between round-robin and geoIP being rapidly eaten up with hassle credits, particularly considering the abstraction layer introduced by DNS caches decoupling user location from DNS server location. I feel that the
really large public DNS caches would only exacerbate this problem to the point that all my effort will be wasted and my time better spent making my site as responsive as it can be, regardless of source. Lots to think about...<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Much obliged,</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Scott<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> bind-users <bind-users-bounces@lists.isc.org> on behalf of G.W. Haywood via bind-users <bind-users@lists.isc.org><br>
<b>Sent:</b> February 23, 2020 7:59 AM<br>
<b>To:</b> bind-users@lists.isc.org <bind-users@lists.isc.org><br>
<b>Subject:</b> Re: Advice on balancing web traffic using geoip ACls</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">Hi there,<br>
<br>
On Sun, 23 Feb 2020, Scott A. Wozny wrote:<br>
<br>
> Greetings BIND gurus,<br>
<br>
Sorry, I can't make any claim to be a BIND guru.<br>
<br>
> ... webserver clusters hosted on the west and east coasts of the US<br>
> and would like to use Bind 9.11.4<br>
<br>
Hmmm. You might want to look e.g. at all the fixes since 9.11.4 in<br>
<br>
<a href="https://downloads.isc.org/isc/bind9/9.11.16/RELEASE-NOTES-bind-9.11.16.html">https://downloads.isc.org/isc/bind9/9.11.16/RELEASE-NOTES-bind-9.11.16.html</a><br>
<br>
> with the Maxmind GeoIP database to split the traffic about evenly ...<br>
<br>
especially the release notes for 9.11.15 if you're sure about MaxMind.<br>
(After the changes in their APIs a while back cost me many weeks of<br>
effort, and some temporary loss in functionality, I'd be very cautious<br>
about relying on them again. It was a completely different scenario.)<br>
<br>
Of course even if you do look at the location of your DNS clients, it<br>
doesn't tell you much about where _their_ clients are, nor much about<br>
the routing of any packets that their clients might exchange with your<br>
webservers. In England I frequently see email from the neighbouring<br>
town that's been routed via Austria, Finland, Japan...<br>
<br>
Wouldn't even random routing or round-robin (basically do nothing) be<br>
easier to implement, faster, more reliable, more (perhaps strangely)<br>
predictable, and ... ?<br>
<br>
<a href="https://en.wikipedia.org/wiki/Round-robin_DNS">https://en.wikipedia.org/wiki/Round-robin_DNS</a><br>
<br>
For your use case I guess you'd really need to instrument something to<br>
know for sure, and by then you've gone and done it anyway. :)<br>
<br>
-- <br>
<br>
73,<br>
Ged.<br>
_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
bind-users@lists.isc.org<br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</div>
</span></font></div>
</div>
</body>
</html>