<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EstiloDeEmail19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="PT-BR" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">I noticed that my setup didn’t reply properly some external entity tried to do recursion, so I digged some more. Based on
<a href="https://doc.powerdns.com/authoritative/guides/recursion.html">https://doc.powerdns.com/authoritative/guides/recursion.html</a>, and modified my config to the following:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">setLocal('0.0.0.0:53')<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">addLocal('[0::0]:53')<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">setACL({'0.0.0.0/0', '::/0'}) -- Allow all IPs access<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">newServer({address='127.0.0.1:5300', pool='auth'})<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">newServer({address='127.0.0.1:5301', pool='recursor'})<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">newServer({address='127.0.0.1:5302', pool='blackhole'})<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">newServer({address='<AD PDC ip address>:53', pool='ad'})<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">addAction({"</span><span lang="EN-US">addomain.internal</span><span lang="EN-US">."}, PoolAction("ad"))<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">addAction({"<undesired domain1>."}, PoolAction("blackhole"))<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">addAction({"<undesired domain2>."}, PoolAction("blackhole"))<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">recursive_ips = newNMG()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">recursive_ips:addMask('127.0.0.0/8')<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">recursive_ips:addMask('::1/128')<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">recursive_ips:addMask('fe80::/10')<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">recursive_ips:addMask(‘<ipv4 range>/24')<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">recursive_ips:addMask('<ipv6 range>/48')<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">addAction(NetmaskGroupRule(recursive_ips), PoolAction('recursor'))<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">addAction(AllRule(), PoolAction('auth'))<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">-- disable security status polling via DNS<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">setSecurityPollSuffix("")<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">-- Webserver. Based in <a href="https://dnsdist.org/guides/webserver.html">
https://dnsdist.org/guides/webserver.html</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">webserver("0.0.0.0:8083", "user", "somepass",{})<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Is that a good config? Any suggestions on something else I should do?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black;mso-fareast-language:PT-BR">Roberto Greiner<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black;mso-fareast-language:PT-BR">Informática-Fundunesp<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:PT-BR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:PT-BR"><img border="0" width="360" height="100" style="width:3.75in;height:1.0416in" id="Imagem_x0020_2" src="cid:image001.png@01D842C2.E0943E90"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="mso-fareast-language:PT-BR">De:</span></b><span style="mso-fareast-language:PT-BR"> dnsdist <dnsdist-bounces@mailman.powerdns.com>
<b>Em nome de </b>Roberto Greiner via dnsdist<br>
<b>Enviada em:</b> segunda-feira, 28 de março de 2022 13:23<br>
<b>Para:</b> dnsdist@mailman.powerdns.com<br>
<b>Assunto:</b> [dnsdist] Config for authoritative resolver and local recursive resolver<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US">I have a setup of PowerDNS where I need to answer all queries for a domain I’ve registered (let’s say mydomain.com). I also want to use the server to answer all requests (recursive or authoritative) originating from my
local network. Since I use AD, some requisitions need to go the AD server (let’s say addomain.internal). Last, I created a blacklist. The authoritative PowerDNS is running in localhost, port 5300, and the blacklist PowerDNS (which will answer 127.0.0.1 for
anything) is in localhost port 5302.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I would like some opinions if the following setup for dnsdist.conf is adequate or if I should change something:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">-- dnsdist configuration file, an example can be found in /usr/share/doc/dnsdist/examples/<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">setLocal('0.0.0.0:53')<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">addLocal('[0::0]:53')<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">setACL({'0.0.0.0/0', '::/0'}) -- Allow all IPs access<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">newServer({address='127.0.0.1:5300', pool='auth'})<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">newServer({address='127.0.0.1:5300', pool='reverse'})<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">newServer({address='127.0.0.1:5302', pool='blackhole'})<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">newServer({address='<ad PDC IP address>:53', pool='ad'})<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">newServer({address="8.8.8.8:53", pool="recursive"})<o:p></o:p></span></p>
<p class="MsoNormal">newServer({address="1.1.1.1:53", pool="recursive"})<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US">-- My black list<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">addAction({"<undesired domain 1>."}, PoolAction("blackhole"))<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">addAction({"<undesired domain 2>."}, PoolAction("blackhole"))<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">addAction({"addomain.internal."}, PoolAction("ad"))<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">addAction({"mydomain.com."}, PoolAction("auth"))<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">-- My IP addresses. I have a class C (/24) IP4 and a /48 IP6<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">addAction({'3.2.1.in-addr.arpa'}, PoolAction("reverse"))<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">addAction({'d.c.b.a.0.9.8.7.6.5.4.3.2.1.ip6.arpa'}, PoolAction("reverse"))<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">-- based in </span><a href="https://boisetech.org/2020/02/25/configuring-dnsdist-a-basic-config/"><span lang="EN-US">https://boisetech.org/2020/02/25/configuring-dnsdist-a-basic-config/</span></a><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">doh_ips=newNMG()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">doh_ips:addMask('0.0.0.0/0')<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">doh_ips:addMask('::/0')<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">addAction(AndRule({NetmaskGroupRule(doh_ips, true), DSTPortRule(5053)}), PoolAction('recursive'))<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">recursive_ips=newNMG()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">recursive_ips:addMask('127.0.0.0/8')<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">recursive_ips:addMask('::1/128')<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">recursive_ips:addMask('fe80::/10')<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">recursive_ips:addMask('1.2.3.0/24')<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">recursive_ips:addMask('123456789abcd::0/64')<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">addAction(NetmaskGroupRule(recursive_ips), PoolAction('recursive'))<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">-- disable security status polling via DNS<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">setSecurityPollSuffix("")<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">-- Webserver. Based in </span><a href="https://dnsdist.org/guides/webserver.html"><span lang="EN-US">https://dnsdist.org/guides/webserver.html</span></a><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">webserver("0.0.0.0:8083", "user", "somepass",{})<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Is this setup adequate? Would someone suggest something different/better?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Tks,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black;mso-fareast-language:PT-BR">Roberto Greiner<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:PT-BR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:PT-BR"><img border="0" width="360" height="100" style="width:3.75in;height:1.0416in" id="Imagem_x0020_1" src="cid:image001.png@01D842C2.E0943E90"></span><span style="mso-fareast-language:PT-BR"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>