<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">On of the suggestions I was given last week for improving PowerDNS performance was to use the proxy protocol available in pdns_recursor 4.4 when passing traffic between dnsdist and pdns_recursor. I’ve finally gotten a chance to test this
setup, but I’m having a problem with getting the recursor to use the proxied client IP for ECS. Recursor.conf at the end.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">If I configure pdns_recursor to listen on the public IP/port 53, I see pdns_recursor adding ECS with the client subnet/24 set correctly.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">If I configure pdns_recursor to listen on the loopback/port 5353, with dnsdist in front (sending proxied requests, proxying verified by Wireshark), pdns_recursor adds ECS using the scope zero IP instead of the client subnet.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Using the same dnsdist/pdns_recursor setup as the previous, but with “ecs-add-for=0.0.0.0/0, ::/0" added to the configuration, I see ECS with ::/56 as the client subnet. Since dnsdist is using “newServer({address='[::1]:5353', useProxyProtocol=true,
sockets=12})”, this suggests that pdns_recursor is ignoring the client IP that was proxied, and using the client IP from the UDP connection instead.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I did try 4.5beta2 as well, but the behavior didn’t change.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Have I missed some setting for telling pdns_recursor to use the proxied client IP in ECS? Is this a bug?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Mark<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">/etc/pdns-recursor/recursor.conf<o:p></o:p></p>
<p class="MsoNormal">----------<o:p></o:p></p>
<p class="MsoNormal">setgid=pdns-recursor<o:p></o:p></p>
<p class="MsoNormal">setuid=pdns-recursor<o:p></o:p></p>
<p class="MsoNormal">version-string=anonymous<o:p></o:p></p>
<p class="MsoNormal">threads=10<o:p></o:p></p>
<p class="MsoNormal">pdns-distributes-queries=yes<o:p></o:p></p>
<p class="MsoNormal">distributor-threads=1<o:p></o:p></p>
<p class="MsoNormal">distribution-load-factor=1.25<o:p></o:p></p>
<p class="MsoNormal">query-local-address=184.60.111.107, 2600:3402:400:2:250:56ff:feb8:7de5<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">allow-from=0.0.0.0/0, ::/0<o:p></o:p></p>
<p class="MsoNormal">proxy-protocol-from=127.0.0.1/8, ::1/128<o:p></o:p></p>
<p class="MsoNormal">edns-subnet-whitelist=tds.net<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">#local-port=5353<o:p></o:p></p>
<p class="MsoNormal">local-port=53<o:p></o:p></p>
<p class="MsoNormal">#local-address=127.0.0.1,::1<o:p></o:p></p>
<p class="MsoNormal">local-address=184.60.111.107, 2600:3402:400:2:250:56ff:feb8:7de5<o:p></o:p></p>
<p class="MsoNormal">lua-dns-script=/etc/pdns-recursor/recursor-script.lua<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-- <o:p></o:p></p>
<p class="MsoNormal">XML combines the efficiency of text files with the readability of binary files<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>