<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Christian,<div class=""><br class=""></div><div class="">Did you take your tcpdump inside the container or outside?</div><div class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 29 May 2019, at 18:42, Christian Tardif <<a href="mailto:christian.tardif@servinfo.ca" class="">christian.tardif@servinfo.ca</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="caret-color: rgb(0, 0, 0); font-family: "Segoe UI"; font-size: 16px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">TCPDUMP for a dig: (request was dig @192.168.213.12 SOA int.servinfo.stba</div><div style="caret-color: rgb(0, 0, 0); font-family: "Segoe UI"; font-size: 16px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br class=""></div><div style="caret-color: rgb(0, 0, 0); font-family: "Segoe UI"; font-size: 16px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">16:33:52.289317 In f8:32:e4:8a:b7:b5 ethertype 802.1Q (0x8100), length 106: vlan 213, p 0, ethertype IPv4, 192.168.213.11.33053 > 192.168.213.12.53: 64585+ [1au] SOA? int.servinfo.stba. (58)<br class="">16:33:52.289317 In f8:32:e4:8a:b7:b5 ethertype 802.1Q (0x8100), length 106: vlan 213, p 0, ethertype IPv4, 192.168.213.11.33053 > 192.168.213.12.53: 64585+ [1au] SOA? int.servinfo.stba. (58)<br class="">16:33:52.289317 In f8:32:e4:8a:b7:b5 ethertype IPv4 (0x0800), length 102: 192.168.213.11.33053 > 192.168.213.12.53: 64585+ [1au] SOA? int.servinfo.stba. (58)<br class=""></div></div></blockquote><div><br class=""></div><div>I assume this is “outside” the container: the ip traffic arrives on the host.</div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div style="caret-color: rgb(0, 0, 0); font-family: "Segoe UI"; font-size: 16px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">16:33:52.289371 Out 02:42:f9:95:2b:46 ethertype IPv4 (0x0800), length 102: 172.17.0.1.1038 > 172.17.0.3.53: 64585+ [1au] SOA? int.servinfo.stba. (58)<br class="">16:33:52.289376 Out 02:42:f9:95:2b:46 ethertype IPv4 (0x0800), length 102: 172.17.0.1.1038 > 172.17.0.3.53: 64585+ [1au] SOA? int.servinfo.stba. (58)<br class="">16:33:52.291796 P 02:42:ac:11:00:03 ethertype IPv4 (0x0800), length 90: 172.17.0.3.53 > 172.17.0.1.1038: 64585 Refused- 0/0/1 (46)<br class="">16:33:52.291796 In 02:42:ac:11:00:03 ethertype IPv4 (0x0800), length 90: 172.17.0.3.53 > 192.168.213.11.33053: 64585 Refused- 0/0/1 (46)<br class=""></div></div></blockquote><div><br class=""></div><div>But then this is strange: the source ip gets translated, which shouldn’t happen. There’s nothing else running on the host that could mess with the traffic? Custom iptables rules, network-agents that intercept the traffic? Special network plugins? How are you starting the container? Could you send us the output of iptables-save?</div><div><br class=""></div><div>The source ip address translation is not (default) docker behaviour. As the ip address is translated, pdns receives the notify from the translated IP instead of the one it should contact.</div><div><br class=""></div><div>Frank</div></div></div><div class=""></div></body></html>