<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Century Gothic";
panose-1:2 11 5 2 2 2 2 2 2 4;}
@font-face
{font-family:tt;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Century Gothic","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D">We struggled with this issue ourselves as well for a long time.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D">We’d like to migrate our current setup where we (scripted) sync records from a ‘master’ database
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D">to the actual databases running on each nameserver, to a setup where we have one ‘master’ MySQL
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D">database and use MySQL replication to all the nameservers (and run them in NATIVE mode only).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D">However, just like Fred if I understood correctly, we currently run our ns2/ns3 in SLAVE mode, and they perform AXFR’s and receive NOTIFY’s.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D">We prefer to let one AXFR-server handle the AXFR’s to update the ‘master’ database (which will then replicate to all nameservers).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D">But there has to be something to forward the incoming NOTIFY’s on the nameservers running in NATIVE mode,
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D">to the AXFR server so that can actually perform the transfer at that point (and not have to wait until slave-cycle-interval,etc).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D">Best regards,<br>
<br>
Wouter<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"> pdns-users-bounces@mailman.powerdns.com [mailto:pdns-users-bounces@mailman.powerdns.com]
<b>On Behalf Of </b>Gary Shaver<br>
<b>Sent:</b> Friday, July 06, 2012 16:05<br>
<b>To:</b> Pdns-users@mailman.powerdns.com<br>
<b>Subject:</b> Re: [Pdns-users] pdns & nproxy<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-family:"tt","serif""><br>
Hi Bert, Fred, List,<br>
<br>
An anycasted nameserver cluster could benefit from this. Initiating an axfr from from a nameserver that is not topologically closest to the master just results in a<br>
failed axfr attempt since the answer does not come back to the slave making the initial request.<br>
<br>
<br>
Gary Shaver<br>
Hurricane Electric<br>
<br>
<o:p></o:p></span></p>
<div style="margin-left:18.75pt;margin-top:22.5pt;margin-right:18.75pt;margin-bottom:7.5pt">
<div style="border:none;border-top:solid #EDEEF0 1.0pt;padding:4.0pt 0in 0in 0in;display:table">
<div>
<p class="MsoNormal" style="vertical-align:middle"><span style="font-family:"tt","serif""><a href="mailto:bert.hubert@netherlabs.nl"><b>bert hubert</b></a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="vertical-align:middle"><span style="font-family:"tt","serif";color:#9FA2A5">July 5, 2012 3:00 PM</span><span style="font-family:"tt","serif""><o:p></o:p></span></p>
</div>
</div>
</div>
<div style="margin-left:.25in;margin-right:.25in">
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"tt","serif";color:#888888"><br>
Interesting. The original use case was where the outside world would never be talking to that master, or at least not taking the initiative to do so. So the outside world would think the nproxy IP address was the slave, and nproxy would then relay that to the
real slave, which would reach out over TCP to make it happen. I think some NAT trick is used to make sure that the outgoing traffic appears as the address that was notified.<br>
<br>
If you want to have this integrated, what exactly is your use case? Better protection for the hidden master?
<br>
<br>
Please don't get me wrong, I get the impression what you want is reasonable, but I can't quite wrap my head around your exact requirements.<br>
<br>
Please let us know!<br>
<br>
Bert<br>
PowerDNS<br>
<br>
_______________________________________________<br>
Pdns-users mailing list<br>
<a href="mailto:Pdns-users@mailman.powerdns.com">Pdns-users@mailman.powerdns.com</a><br>
<a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br>
<br>
<br>
!DSPAM:4ff60e6d270271029916480!<o:p></o:p></span></p>
</div>
</div>
<div style="margin-left:18.75pt;margin-top:22.5pt;margin-right:18.75pt;margin-bottom:7.5pt">
<div style="border:none;border-top:solid #EDEEF0 1.0pt;padding:4.0pt 0in 0in 0in;display:table">
<div>
<p class="MsoNormal" style="vertical-align:middle"><span style="font-family:"tt","serif""><a href="mailto:rom@twister.dyndns.org"><b>Fred Wittekind</b></a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="vertical-align:middle"><span style="font-family:"tt","serif";color:#9FA2A5">July 5, 2012 11:18 AM</span><span style="font-family:"tt","serif""><o:p></o:p></span></p>
</div>
</div>
</div>
<div style="margin-left:.25in;margin-right:.25in">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#888888">I'm working on deploying pdns, and we had intended to use native replication (mysql-replication).<br>
<br>
Our idea was to have one master dns server that sits behind a firewall, and our public facing servers replicate from it. This works well for 90%+ of the domains we host. We do have a few we have to slave from our clients though.<br>
<br>
My original plan was to have nproxy sit on the public facing name servers to forward the notify to the master dns server behind the firewall, the master then does the axfr from our client's server, populates mysql with the new zone info, that then replicates
out to the public facing servers.<br>
<br>
Then I got this error when trying to start nproxy (IP address censored):<br>
</span><span style="font-family:"tt","serif";color:#888888">nproxy: Fatal: Binding socket for incoming packets to 'a.b.c.d:53': Address already in use
<br>
<br>
Which of course makes sense after seeing it, pdns is already binding to the same IP/port.<br>
<br>
So, my question is this... Can the functionality of nproxy be rolled into pdns so that pdns itself can forward the notify to another instance of pdns (on the master server), or can nproxy and pdns be made to work on the same IP. I looked into trying to see
if I could get iptables to split out the notify messages to a different destination IP so I could put nproxy on a different IP than pdns, but, I didn't figure out a good (reliable) way to do this.<br>
<br>
Any help would be appreciated.<br>
<br>
Fred Wittekind<br>
!DSPAM:4ff5da85151923326710967! <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"tt","serif";color:#888888">_______________________________________________<br>
Pdns-users mailing list<br>
<a href="mailto:Pdns-users@mailman.powerdns.com">Pdns-users@mailman.powerdns.com</a><br>
<a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-family:"tt","serif""><o:p> </o:p></span></p>
</div>
</div>
</div>
</body>
</html>