sslip.io

Operational Status: ci.nono.io [Status]

sslip.io is a DNS (Domain Name System) service that, when queried with a hostname with an embedded IP address, returns that IP Address. It was inspired by xip.io, which was created by Sam Stephenson.

Here are some examples:

Hostname / URL IP Address Notes
https://104.155.144.4.sslip.io 104.155.144.4 dot separators, sslip.io website mirror (IPv4)
https://52-0-56-137.sslip.io 52.0.56.137 dash separators, sslip.io website mirror (IPv4)
www.192.168.0.1.sslip.io 192.168.0.1 subdomain
www.192-168-0-1.sslip.io 192.168.0.1 subdomain + dashes
https://www-78-46-204-247.sslip.io 78.46.204.247 dash prefix, sslip.io website mirror (IPv4)
--1.sslip.io ::1 IPv6 — always use dashes, never dots
https://2a01-4f8-c17-b8f--2.sslip.io 2a01:4f8:c17:b8f::2 sslip.io website mirror (IPv6)

Branding / White Label / Custom Domains

sslip.io can be used to brand your own site (you don’t need to use the sslip.io domain). For example, say you own the domain “example.com”, and you want your subdomain, “xip.example.com” to have xip.io-style features. To accomplish this, set the following three DNS servers as NS records for the subdomain “xip.example.com”

hostname IP address Location
ns-aws.nono.io. 52.0.56.137
2600:1f18:aaf:6900::a		 USA
ns-gce.nono.io. 104.155.144.4 USA
ns-azure.nono.io. 52.187.42.158 Singapore

Let’s test it from the command line using dig:

dig @ns-gce.nono.io. 169-254-169-254.xip.example.com +short

Yields, hopefully: [connection timed out]

169.254.169.254

But I Want My Own DNS Server!

If you want to run your own DNS server, it's simple: you can compile from source or you can use one of our pre-built binaries. In the following example, we install & run our server within a docker container:

docker run -it --rm fedora
curl -L https://github.com/cunnie/sslip.io/releases/download/2.2.0/sslip.io-dns-server-linux-amd64 -o dns-server
chmod +x dns-server
./dns-server 2> dns-server.log &
dnf install -y bind-utils
dig @localhost 127-0-0-1.sslip.io +short # returns "127.0.0.1"

TLS

You can acquire TLS certificates for your externally-accessible hosts from certificate authorities (CAs) such as Let's Encrypt. The easiest mechanism to acquire a certificate would be to use the HTTP-01 challenge. It requires, at a minimum, a web server running on your machine. The Caddy web server is one of the most popular examples. For example, if you had a webserver with the IP address 52.0.56.137, you could obtain a TLS certificate for "52.0.56.137.sslip.io", or "www.52.0.56.137.sslip.io", or "prod.www-52-0-56-137.sslip.io".

If you have procured a wildcard certificate for your branded / white label / custom sslip.io-style subdomain, you may install it on your machines for TLS-verified connections.

When using a TLS wildcard certificate in conjunction with your branded sslip.io style subdomain, you must use dashes not dots as separators. For example, if you have the TLS certificate for *.xip.example.com, you could browse to https://www-52-0-56-137.xip.example.com/ but not https://www.52.0.56.137.xip.example.com/.

if you're interested in acquiring a wildcard certificate for your sslip.io domain, e.g. "*.52-0-56-137.sslip.io", the procedure is described here.

Determining Your External IP Address via DNS Lookup

You can use sslip.io's DNS servers (ns-aws.nono.io, ns-azure.nono.io, ns-gce.nono.io) to determine your public IP address by querying the TXT record of the root domain. If you're curious about your public IPv6 address, use the DNS server ns-aws.nono.io, for it has both IPv4 and IPv6 addresses:

dig @ns-aws.nono.io txt . +short    # sample reply "2607:fb90:464:ae1e:ed60:29c:884c:4b52"
dig @ns-aws.nono.io txt . +short -4 # forces IPv4 lookup; sample reply "172.58.35.231"
dig @ns-aws.nono.io txt . +short -6 # forces IPv6 lookup; sample reply "2607:fb90:464:ae1e:ed60:29c:884c:4b52"

This feature was inspired by Google's DNS lookup, i.e. dig txt o-o.myaddr.l.google.com @8.8.8.8 +short. There are also popular HTTP-based services for determining your public IP address:

A big advantage of using DNS queries instead of HTTP queries is bandwidth: querying ns-aws.nono.io requires a mere 592 bytes spread over 2 packets; Querying https://icanhazip.com/ requires 8692 bytes spread out over 34 packets—over 14 times as much! Admittedly bandwidth usage is a bigger concern for the one hosting the service than the one using the service.

Footnotes

[Status] A status of “build failing” rarely means the system is failing. It’s more often an indication that when the servers were last checked (currently every six hours), the CI (continuous integration) server had difficulty reaching one of the three sslip.io nameservers. That’s normal. [connection timed out]

[connection timed out]

DNS runs over UDP which has no guaranteed delivery, and it’s not uncommon for the packets to get lost in transmission. DNS clients are programmed to seamlessly query a different server when that happens. That’s why DNS, by fiat, requires at least two nameservers (for redundancy). From IETF (Internet Engineering Task Force) RFC (Request for Comment) 1034:

A given zone will be available from several name servers to insure its availability in spite of host or communication link failure. By administrative fiat, we require every zone to be available on at least two servers, and many zones have more redundancy than that.