JANOG57 NETCON Walkthrough (Level 3-2): DNS and CDN Caching

I helped create and score the NETCON challenges again at JANOG57. This post explains level 3-2.

The challenge focuses on DNS and CDNs, bringing application-layer networking into a competition where it is relatively uncommon.

Level 3-2 overview

Topology

Problem statement

You have taken over a project to put a customer’s website behind a CDN. The handover includes some requirements and origin specifications, but it may be incomplete.

The customer manages the origin website, and you cannot change its configuration. You are allowed to change the DNS server configuration.

Origin-01 specifications

• FQDN: origin.example.com
• IP: 192.0.2.100
• Authentication: checks for the X-Auth-String: netcon header
• Note: may return an unnecessary Set-Cookie header left over from earlier tests

DNS-01 specifications

• IP: 192.0.2.10
• Init system: OpenRC
• Software: BIND
• Zone file: /etc/bind/example.com.zone

CDN-01 specifications

• FQDN: www.example.com
• IP: 203.0.113.1
• Init system: OpenRC
• Software: Varnish
• Configuration file: /etc/varnish/default.vcl

Adjust DNS-01 and CDN-01 to satisfy the following requirements.

Success criteria

• curl http://www.example.com/ from Client-01 succeeds with 200 OK.
• Requests from Client-01 to http://www.example.com/ receive cached responses, indicated by X-Cache: HIT. Adjust the response so Varnish caches it under its default rules, rather than forcing it into the cache.
• Requests to http://www.example.com/now bypass the cache and return X-Cache: MISS.
• Responses for /now prevent browser caching by including Cache-Control: no-store.

Restrictions

• Only additions are allowed in /etc/bind/example.com.zone on DNS-01. Do not delete existing configuration.
• Name resolution must use DNS-01. Do not use hosts files.
• Only additions are allowed in /etc/varnish/default.vcl on CDN-01. Do not delete existing configuration.

Initial configuration

DNS-01

$TTL 3600
@ IN SOA ns1.example.com. admin.example.com. (
    2025010101
    3600
    900
    604800
    86400
)

        IN NS ns1.example.com.

ns1     IN A 192.0.2.10
@       IN A 192.0.2.100
origin  IN A 192.0.2.100

CDN-01

vcl 4.0;

backend default {
    .host = "origin.example.com";
    .port = "80";
    .host_header = "origin.example.com";
}

sub vcl_deliver {
    if (obj.uncacheable) {
    set resp.http.X-Cacheable = "NO";
    } else {
    set resp.http.X-Cacheable = "YES";
    }

    if (obj.hits > 0) {
    set resp.http.X-Cache = "HIT";
    } else {
    set resp.http.X-Cache = "MISS";
    }
}

Expected solution

1. Add the www record on DNS-01

$TTL 3600
@ IN SOA ns1.example.com. admin.example.com. (
    2025010101
    3600
    900
    604800
    86400
)

        IN NS ns1.example.com.

ns1     IN A 192.0.2.10
@       IN A 192.0.2.100
origin  IN A 192.0.2.100
www     IN A 203.0.113.1  # Added

2. Add the Varnish configuration on CDN-01 and restart the service

vcl 4.0;

backend default {
    .host = "origin.example.com";
    .port = "80";
    .host_header = "origin.example.com";
}

sub vcl_recv {
    # Bypass the cache for /now or /now/
    if (req.url ~ "^/now(/|$)") {
        return (pass);
    }
}

sub vcl_backend_fetch {
    # Set Host and X-Auth-String for origin requests
    set bereq.http.Host = "origin.example.com";
    set bereq.http.X-Auth-String = "netcon";
}

sub vcl_backend_response {
    # Remove Set-Cookie from the response for /
    if (bereq.url ~ "^/$") {
        unset beresp.http.Set-Cookie;
    }
}

sub vcl_deliver {
    # Prevent browser caching
    if (obj.uncacheable) {
    set resp.http.X-Cacheable = "NO";
    set resp.http.Cache-Control = "no-store, no-cache, must-revalidate, max-age=0";
    set resp.http.Pragma = "no-cache";
    set resp.http.Expires = "0";
    } else {
    set resp.http.X-Cacheable = "YES";
    }

    if (obj.hits > 0) {
    set resp.http.X-Cache = "HIT";
    } else {
    set resp.http.X-Cache = "MISS";
    }
}

Explanation

• vcl_recv: Receiving the request
  • Bypass the cache for /now and send the request directly to the origin using return (pass).
• vcl_backend_fetch: Sending the origin request
  • Set the Host header to origin.example.com.
  • Set X-Auth-String to netcon for origin authentication.
• vcl_backend_response: Receiving the origin response
  • Remove Set-Cookie for /.
  • Varnish’s default behavior avoids caching responses that set a cookie, so removing the unnecessary header allows the homepage to be cached.
• vcl_deliver: Returning the client response
  • For uncacheable responses, add headers that prevent browser caching.
  • The scoring required no-store; the example also includes additional cache headers for compatibility.

Closing thoughts

Thank you to everyone who worked on this challenge.

Network engineers may not get many opportunities to configure CDNs. I hope this problem helped broaden your experience.