<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta content="text/html; charset=utf-8">
<meta name="qrichtext" content="1">
<style type="text/css">
<!--
p, li
{white-space:pre-wrap}
-->
</style>
</head>
<body style="font-family:'Droid Sans'; font-size:9pt; font-weight:400; font-style:normal">
<p dir="ltr">Great explanation Ales, tomorrow i will work on it.</p>
<p dir="ltr">There is any way in which each dnsdist know the existence of the other?</p>
<p dir="ltr">Alejandro</p>
<div class="gmail_quote">El 14/1/2016 11:04 p. m., Aleš Rygl <ales@rygl.net> escribió:<br type="attribution">
</div>
<div>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
Hi Alejandro,</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
You are right. dnsdist receives the query and forwards it to the recursor. I do not see a reason for binding auth servers together with recursors directly unless you have a special reason. Your recursors will be able to resolve your domains serverd by your
auth. DNS based on the DNS hierarchy anyway.</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
I would start like that:</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
1. make sure your recursors are working fine without dnsdist first. </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
If you want to use the dnsdist on the same box, make sure, they listen just in port 7753 and they are not using port 53 (use netstat -tunlp), otherwise dnsdist will fail to start. You could also assign a secondary IP and use it just for dnsdist. Perform some
queries to them with dig command with the option -p 7753. Check, if they are able to resolve the domains served by your auth DNS.</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
2. run dnsdist on the boxes with recursor. It will listen on <span style="font-size:12px; color:#000000; background-color:#f4eae7">
93.47.xxx.34:53 and 93.47.xxx.35:53 on the 2nd box. </span>Use 127.0.0.1:7553 in the server config on each of them first.</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
3. This should work. Each recursor will have dnsdist as a frontend forwarding traffic localy. Verify with dig <a hostname> @<span style="font-size:12px; color:#000000; background-color:#f4eae7">93.47.xxx.34 and @93.47.xxx.35.</span></p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
If it works you can try to add the 2nd recursor IP to the config of the 1st dnsdist and vice versa in order to have a balanced solution...</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
Regards</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
Ales</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> AUTH SERVERS (there is a mysql replication between them, from 1 to 2)</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> AUTH1 93.47.xxx.32 (pdns server & mysql backend) - Listening on</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> 93.47.xxx.32:53 pointing to RECURSOR1 on port 7753 AUTH2 93.47.xxx.33 (pdns</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> server & mysql backend) - Listening on port 93.47.xxx.33:53 pointing to</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> RECURSOR2 on port 7753 RECURSOR SERVERS (I want to integrate these 2</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> dnsdist to have 2 loadbalancers pointing this 2 recursors) RECURSOR1</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> 93.47.xxx.34 (pdns-recursor & dnsdist) - Recursor listening on port</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> 93.47.xxx.34:7753 - Dnsdist listening on port 93.47.xxx.34:53 RECURSOR2</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> 93.47.xxx.35 (pdns-recursor & dnsdist) - Recursor listening on port</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> 93.47.xxx.35:7753 - Dnsdist listening on port 93.47.xxx.35:53</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> It's possible? Or maybe I'm wrong understanding in which layer I must use</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> dnsdist?</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> As far as I understand, dnsdist must be one that receives requests and</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> distributes them to the recursors, which send the request to the</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> authoritative DNS server.</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> Thanks a lot DNSfriends!!</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> -----Original Message-----</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> From: Aleš Rygl [mailto:ales@rygl.net]</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> Sent: jueves, 14 de enero de 2016 16:41</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> To: dnsdist@mailman.powerdns.com</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> Cc: Alejandro Adroher Mellado <alejandro.adroher@omniaccess.com>; Pieter</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> Lexis <pieter.lexis@powerdns.com> Subject: Re: [dnsdist] Rate Limiting</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> Against DDOS</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> Hi Alejandro,</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> I am using a tiny dnsdist setup (so far) together with keepalived on two</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> boxes. There are following servers configured:</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> newServer({address="93.153.116.35:53", name="rzt-entdns3", qps=1000,</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> order=1, weight=1, retries=5, tcpSendTimeout=30, tcpRecvTimeout=30})</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> newServer({address="127.0.0.1:53", name="rzt-entdns2", qps=1000, order=1,</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> weight=1, retries=5, tcpSendTimeout=30, tcpRecvTimeout=30})</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> setServerPolicy(wrandom)</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> controlSocket("127.0.0.1")</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> addLocal("93.153.116.33:53")</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> dnsdist listens on 93.153.116.33 (VIP) and distributes queries to 127.0.0.1</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> (local recursor) and renote one at 93.153.116.35. Using keepalived</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> collocated with an recursor can migrate VIP and play with the servers</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> without an impact and have just two boxes. No rocket science, just works.</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> Ales</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> On Thursday 14 of January 2016 15:24:26 Alejandro Adroher Mellado wrote:</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > I am able to make work dnsdist and recursors only when they are placed on</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > different servers, when I do that on the same server as I want (can</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > someone</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > tell me if it's a good practice?), I cannot reach to LISTEN udp on port 53</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > ....</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > -----Original Message-----</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > From: dnsdist-bounces@mailman.powerdns.com</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > [mailto:dnsdist-bounces@mailman.powerdns.com] On Behalf Of Pieter Lexis</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > Sent: jueves, 14 de enero de 2016 16:05</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > To: dnsdist@mailman.powerdns.com</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > Subject: Re: [dnsdist] Rate Limiting Against DDOS</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > Hi Alejandro,</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > On Thu, 14 Jan 2016 15:01:28 +0000</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > Alejandro Adroher Mellado <alejandro.adroher@omniaccess.com> wrote:</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > > (on documentation is placed on /etc/dnsdist.conf but on my recent</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > > installed dnsdist it's placed on /etc/init/dnsdist.conf)</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > The correct location (when using a package) is /etc/dnsdist/dnsdist.conf.</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > The /etc/init/dnsdist.conf is for the upstart init-system.</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > --</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > Pieter Lexis</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > PowerDNS.COM BV -- https://www.powerdns.com</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > _______________________________________________</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > dnsdist mailing list</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > dnsdist@mailman.powerdns.com</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > http://mailman.powerdns.com/mailman/listinfo/dnsdist</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > </p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > _______________________________________________</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > dnsdist mailing list</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > dnsdist@mailman.powerdns.com</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
> > http://mailman.powerdns.com/mailman/listinfo/dnsdist</p>
<p style="margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; text-indent:0px">
</p>
</div>
</body>
</html>