<div dir="ltr"><div dir="ltr">Hi Brian,<br><br>Thanks for your reply. I'm still a bit stumped, those long nights and a bit of lack of understanding on my part as to the "why" I can't get it to work.<br><br>The <a href="http://geo.hotchilli.co.uk">geo.hotchilli.co.uk</a> resolves as geoip from france, US, UK, Germany, Canada etc very slick but I am stumped on the ALIAS for the apex domain <a href="http://hotchilli.co.uk">hotchilli.co.uk</a><br><br>I have split the recursor onto another host and set on the auth server to:<br><br>resolver=<a href="http://46.17.216.219:5300">46.17.216.219:5300</a><br>expand-alias=yes<br>edns-subnet-processing=yes<br><br>recursor has this which I pretty sure is far too much and of course some I don't understand<br><br>allow-from=46.17.216.218, 46.17.217.219, <a href="http://46.17.216.0/21">46.17.216.0/21</a>, 127.0.0.1, <a href="http://127.0.0.0/8">127.0.0.0/8</a>, <a href="http://10.0.0.0/8">10.0.0.0/8</a>, <a href="http://100.64.0.0/10">100.64.0.0/10</a>, <a href="http://169.254.0.0/16">169.254.0.0/16</a>, <a href="http://192.168.0.0/16">192.168.0.0/16</a>, <a href="http://172.16.0.0/12">172.16.0.0/12</a>, ::1/128, fc00::/7, fe80::/10<br>config-dir=/etc/powerdns<br>ecs-add-for=<a href="http://0.0.0.0/0,::/0">0.0.0.0/0,::/0</a>, !<a href="http://46.17.216.218/32">46.17.216.218/32</a>, !<a href="http://46.17.217.219/32">46.17.217.219/32</a>, !<a href="http://46.17.216.219/32">46.17.216.219/32</a>, !<a href="http://127.0.0.0/8">127.0.0.0/8</a>, !<a href="http://10.0.0.0/8">10.0.0.0/8</a>, !<a href="http://100.64.0.0/10">100.64.0.0/10</a>, !<a href="http://169.254.0.0/16">169.254.0.0/16</a>, !<a href="http://192.168.0.0/16">192.168.0.0/16</a>, !<a href="http://172.16.0.0/12">172.16.0.0/12</a>, !::1/128, !fc00::/7, !fe80::/10<br>ecs-cache-limit-ttl=0<br>ecs-ipv4-bits=24<br>ecs-ipv4-cache-bits=24<br>ecs-ipv6-bits=56<br>ecs-ipv6-cache-bits=56<br>edns-subnet-whitelist= <a href="http://0.0.0.0/0">0.0.0.0/0</a>, ::<br>gettag-needs-edns-options=yes<br>use-incoming-edns-subnet=yes<br>hint-file=/usr/share/dns/root.hints<br>include-dir=/etc/powerdns/recursor.d<br>local-address=46.17.216.219<br>local-port=5300<br>lua-config-file=/etc/powerdns/recursor.lua<br>quiet=yes<br>setgid=pdns<br>setuid=pdns<br>loglevel=9<br>logging-facility=0<br>trace=on<br><br>No idea when when the auth server sends a request to the recursor I see (
Adding EDNS Client Subnet Mask <a href="http://127.0.0.1/32">127.0.0.1/32</a> to query) I was hoping for the IP for all the clients which the auth server must be getting.<br><br>Jun 16 18:04:33 dnsr0-hot pdns_recursor[77524]: [136] <a href="http://geo.hotchilli.co.uk">geo.hotchilli.co.uk</a>: Trying IP <a href="http://46.17.216.218:53">46.17.216.218:53</a>, asking '<a href="http://geo.hotchilli.co.uk">geo.hotchilli.co.uk</a>|A'<br>Jun 16 18:04:33 dnsr0-hot pdns_recursor[77524]: [136] <a href="http://geo.hotchilli.co.uk">geo.hotchilli.co.uk</a>: Adding EDNS Client Subnet Mask <a href="http://127.0.0.1/32">127.0.0.1/32</a> to query<br>Jun 16 18:04:33 dnsr0-hot pdns_recursor[77524]: [136] <a href="http://geo.hotchilli.co.uk">geo.hotchilli.co.uk</a>: Received EDNS Client Subnet Mask <a href="http://127.0.0.0/21">127.0.0.0/21</a> on response<br><br>also appears to be cached, ok if it caches based on subnet<br>Jun 16 18:25:34 dnsr0-hot pdns_recursor[78388]: [3] <a href="http://geo.hotchilli.co.uk">geo.hotchilli.co.uk</a>: Found cache hit for A: 46.17.220.152[ttl=56]<br><br>with the subnet of
<a href="http://127.0.0.1/32">127.0.0.1/32</a> all countries returning
46.17.220.152 of course<br><br>So what does work perfectly is:<br><br>dnsdist -----> auth revolving geoip for <a href="http://geo.hotchilli.co.uk">geo.hotchilli.co.uk</a>, so the subnet passes dnsdist to auth<br><br>Now either the client subnet doesn't pass from auth directly to the recursor or my recursor has the wrong config. I am going to assume for a minute it's my recursor config as there is so little config on the auth server. (3 lines)<br><br>Please can I ask on this list what is the min config on the recursor for the ALIAS to resolve based on the client subnet which is passed from the auth server.<br><br>Many Thanks<br><br>Tony Turner<br><br><br><br><br><br><br><br><br><br><br><br><br> </div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Jun 14, 2021 at 9:21 AM Brian Candler <<a href="mailto:b.candler@pobox.com">b.candler@pobox.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">$ dig +short @<a href="http://dns0.hotchilli.uk" rel="noreferrer" target="_blank">dns0.hotchilli.uk</a>. <a href="http://geo.hotchilli.co.uk" rel="noreferrer" target="_blank">geo.hotchilli.co.uk</a>. a<br>
46.17.220.152<br>
$ dig +short @<a href="http://dns0.hotchilli.uk" rel="noreferrer" target="_blank">dns0.hotchilli.uk</a>. <a href="http://hotchilli.co.uk" rel="noreferrer" target="_blank">hotchilli.co.uk</a>. a<br>
10.0.2.18<br>
<br>
I see that's the response you configured for "<a href="http://unknown.geo.hotchilli.co.uk" rel="noreferrer" target="_blank">unknown.geo.hotchilli.co.uk</a>"<br>
<br>
I'd be inclined to use tcpdump to look at queries from dist to auth, <br>
auth to recursor, and recursor to auth - and check the flow of packets <br>
when you send an external query for "<a href="http://hotchilli.co.uk" rel="noreferrer" target="_blank">hotchilli.co.uk</a>". My guess is that <br>
the source subnet of the original query isn't propagating all the way <br>
through, and maybe you can identify at which step it's lost.<br>
<br>
I do wonder if there's a better way; perhaps dnsdist itself could map <br>
<a href="http://hotchilli.co.uk" rel="noreferrer" target="_blank">hotchilli.co.uk</a> to <a href="http://geo.hotchilli.co.uk" rel="noreferrer" target="_blank">geo.hotchilli.co.uk</a>? But I don't use dnsdist myself.<br>
<br>
</blockquote></div></div>