<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
I agree, it shouldn’t, but what pens sees is 127.0.0.1 (apparently) despite having configured trusted-notification-proxy in pdns, so pdns will try to query localhost (which just so happens to be dnsdist) instead of the real primary server that sent the NOTIFY
call.
<div class=""><br class="">
</div>
<div class="">Someone off list made a suggestion to use `also-notify` on the hidden primary to notify pdns bypassing dnsdist on a different port (5300 in my case) which is a solution obviously, and a rather simple one.<br class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">On 7 Jun 2022, at 13:50, Adrian Kägi via dnsdist <<a href="mailto:dnsdist@mailman.powerdns.com" class="">dnsdist@mailman.powerdns.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">Hi<br class="">
Maybe i did not understand correct, but the AXFR zone transfer from primary to secondary should not be routed via DNSdist. from my point of view, makes no sense.<br class="">
<br class="">
Cheers<br class="">
<br class="">
<br class="">
On Tue. 7. June 2022 10:02 CEST, Lucas Rolff via dnsdist <<a href="mailto:dnsdist@mailman.powerdns.com" class="">dnsdist@mailman.powerdns.com</a>> wrote:<br class="">
<blockquote type="cite" cite="x-msg://6/4569092C-A032-450B-8964-8E674425F730@lucasrolff.com" class="">
</blockquote>
Hi guys,
<div class=""> </div>
<div class="">I want to gather DNS query information from my powerdns setup, and since powerdns doesn’t support dnstap it means deploying dnsdist in front of powerdns.</div>
<div class=""> </div>
<div class="">My powerdns setup has a hidden primary that cannot be queried from the outside except a small amount of IPs, and transfers from the primary to the secondary is done via AXFR and NOTIFY.</div>
<div class=""> </div>
<div class="">Now, the issue is when I put dnsdist in front of powerdns, the NOTIFY calls obviously end up at dnsdist instead of powerdns, and dnsdist then pass on the NOTIFY call to powerdns running on localhost port 5300.</div>
<div class=""> </div>
<div class="">Per the documentation in <a href="https://dnsdist.org/advanced/axfr.html" class="">https://dnsdist.org/advanced/axfr.html</a> I’ve used the last “addAction” to check if NOTIFY calls come from the hidden primary, and I’ve put 127.0.0.1 in the trusted-notification-proxy
setting in PowerDNS.</div>
<div class="">When NOTIFY calls arrive, the secondary tries to do a SOA check to 127.0.0.1 instead of the actual hidden primary, and I end up with:</div>
<div class=""> </div>
<div class="">```</div>
<div class="">
<div class="">Jun 4 09:10:30 ns1 pdns_server[789]: Received NOTIFY for my <a href="http://domain.com/" class="">
domain.com</a> from 127.0.0.1:33941 for which we are not authoritative, trying supermaster</div>
<div class="">Jun 4 09:10:30 ns1 pdns_server[789]: Error resolving SOA or NS for <a href="http://domain.com/" class="">domain.com</a> at: 127.0.0.1: Query to '127.0.0.1' for SOA of <a href="http://domain.com/" class="">domain.com</a>' produced no answers</div>
</div>
<div class="">```</div>
<div class=""> </div>
<div class="">Now, I could do another action that would redirect SOA, AXFR and IXFR to the primary, but ideally I don’t want that if a random client decides to do `dig
<a href="http://mydomain.com/" class="">mydomain.com</a> SOA @ns1.dnsserver.com` that those queries are then redirected to the hidden primary.</div>
<div class="">Is there any way to solve this? I’d somehow have expected that the SOA query would happen towards the “real” primary that sends the NOTIFY call when trusted-notification-proxy is set, but that doesn’t seem to be the case.</div>
<div class=""> </div>
<div class="">In all honesty, I’m not sure whether I have to fix something in dnsdist or powerdns, but considering I only face the issue when running dnsdist, I’m using this mailing-list.</div>
<div class=""> </div>
<div class="">My end goal is that my secondaries can get updates and new zones added correctly even when dnsdist is in front, and at the same time not open up for SOA being redirected to the hidden primary for normal DNS clients querying the secondaries.</div>
<div class=""> </div>
<div class="">Do anyone have pointers what could be done in this case?</div>
<div class=""> </div>
<div class="">Thanks in advance, and thanks for an awesome piece of software :)</div>
<br class="">
<br class="">
_______________________________________________<br class="">
dnsdist mailing list<br class="">
<a href="mailto:dnsdist@mailman.powerdns.com" class="">dnsdist@mailman.powerdns.com</a><br class="">
https://mailman.powerdns.com/mailman/listinfo/dnsdist<br class="">
</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>