<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr"></div><div dir="ltr">I used these instructions and it was up and running within minutes. </div><div dir="ltr"><br></div><div dir="ltr"><a href="https://doc.powerdns.com/recursor/PowerDNS-Recursor.pdf">https://doc.powerdns.com/recursor/PowerDNS-Recursor.pdf</a></div><div dir="ltr"><br></div><div dir="ltr">Make sure you have your allow list and your listening on IP 127.0.0.1 and the IP address of your Ethernet card </div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr"><br>On Oct 20, 2021, at 5:42 PM, Alessandro Dentella via Pdns-users <pdns-users@mailman.powerdns.com> wrote:<br><br></div><div dir="ltr"><span></span><br><span>Hi,</span><br><span></span><br><span></span><br><span>I setup a PowerDNS Recursor that I would like to use as forwarder for a tiny</span><br><span>kubernetes cluster made with microk8s (that uses coredns).</span><br><span></span><br><span>I experiment failures of all queries to an internal domain (that has an</span><br><span>authorative PowerDNS isntance and is declared via forward-zones=thux.lan=...)</span><br><span>if made within a pod (and forwarded by coredns)</span><br><span></span><br><span>I cannot understand if there's something wrong in how I setup the domain, the</span><br><span>recursor or coredns.</span><br><span></span><br><span></span><br><span>If I operate from the node (as opposed to within the container), I notice that</span><br><span>`host` always work while dig does not:</span><br><span></span><br><span> adk-c1:/home/src/setup-cluster/12-dns # dig dns1b.thux.lan @10.2.201.135</span><br><span></span><br><span> ; <<>> DiG 9.16.1-Ubuntu <<>> dns1b.thux.lan @10.2.201.135</span><br><span> ;; global options: +cmd</span><br><span> ;; Got answer:</span><br><span> ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 3509</span><br><span> ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1</span><br><span></span><br><span> ;; OPT PSEUDOSECTION:</span><br><span> ; EDNS: version: 0, flags:; udp: 512</span><br><span> ;; QUESTION SECTION:</span><br><span> ;dns1b.thux.lan. IN A</span><br><span></span><br><span> ;; Query time: 4 msec</span><br><span> ;; SERVER: 10.2.201.135#53(10.2.201.135)</span><br><span> ;; WHEN: Wed Oct 20 21:26:59 UTC 2021</span><br><span> ;; MSG SIZE rcvd: 43</span><br><span></span><br><span> adk-c1:/home/src/setup-cluster/12-dns # host dns1b.thux.lan 10.2.201.135</span><br><span> Using domain server:</span><br><span> Name: 10.2.201.135</span><br><span> Address: 10.2.201.135#53</span><br><span> Aliases: </span><br><span></span><br><span> dns1b.thux.lan has address 10.2.201.135</span><br><span></span><br><span></span><br><span>I tried setting:</span><br><span></span><br><span> edns-subnet-allow-list=thux.lan</span><br><span></span><br><span>but the problem persists. Can I configure PowerDNS recursor so that it answers</span><br><span>correctly to coredns and dig?</span><br><span></span><br><span>If I go directly to the Authoritative, it always answers correctly.</span><br><span></span><br><span>Below the tcpdum -vv of the 3 situations:</span><br><span></span><br><span> a) failing 'dig'</span><br><span> b) working 'host'</span><br><span> c) failing nslookup via coredns</span><br><span></span><br><span>TIA</span><br><span>sandro</span><br><span>*:-)</span><br><span></span><br><span>failing dig</span><br><span>===========</span><br><span></span><br><span>3:36:57.685822 IP (tos 0x0, ttl 62, id 7456, offset 0, flags [none], proto UDP (17), length 83)</span><br><span> 10.1.201.111.50970 > 10.2.201.135.53: [udp sum ok] 5350+ [1au] A? dns1b.thux.lan. ar: . OPT UDPsize=4096 [COOKIE 5793a6f5b3b006fd] (55)</span><br><span>23:36:57.686197 IP (tos 0x0, ttl 63, id 45508, offset 0, flags [none], proto UDP (17), length 71)</span><br><span> 10.2.201.135.53 > 10.1.201.111.50970: [bad udp cksum 0xa73e -> 0x6d47!] 5350 ServFail q: A? dns1b.thux.lan. 0/0/1 ar: . OPT UDPsize=512 (43)</span><br><span></span><br><span></span><br><span>working 'host'</span><br><span>==============</span><br><span></span><br><span>tcpdump: listening on ens19, link-type EN10MB (Ethernet), snapshot length 262144 bytes</span><br><span>23:36:44.554022 IP (tos 0x0, ttl 62, id 4657, offset 0, flags [none], proto UDP (17), length 60)</span><br><span> 10.1.201.111.57686 > 10.2.201.135.53: [udp sum ok] 52844+ A? dns1b.thux.lan. (32)</span><br><span>23:36:44.554368 IP (tos 0x0, ttl 63, id 43433, offset 0, flags [none], proto UDP (17), length 76)</span><br><span> 10.2.201.135.53 > 10.1.201.111.57686: [bad udp cksum 0xa743 -> 0x2d04!] 52844 q: A? dns1b.thux.lan. 1/0/0 dns1b.thux.lan. A 10.2.201.135 (48)</span><br><span>23:36:44.555049 IP (tos 0x0, ttl 62, id 4658, offset 0, flags [none], proto UDP (17), length 60)</span><br><span> 10.1.201.111.49752 > 10.2.201.135.53: [udp sum ok] 21562+ AAAA? dns1b.thux.lan. (32)</span><br><span>23:36:44.555328 IP (tos 0x0, ttl 63, id 43434, offset 0, flags [none], proto UDP (17), length 141)</span><br><span> 10.2.201.135.53 > 10.1.201.111.49752: [bad udp cksum 0xa784 -> 0x38d6!] 21562 q: AAAA? dns1b.thux.lan. 0/1/0 ns: thux.lan. SOA a.misconfigured.dns.server.invalid. hostmaster.thux.lan. 2021092801 10800 3600 604800 3600 (113)</span><br><span>23:36:44.555887 IP (tos 0x0, ttl 62, id 4659, offset 0, flags [none], proto UDP (17), length 60)</span><br><span> 10.1.201.111.52413 > 10.2.201.135.53: [udp sum ok] 54816+ MX? dns1b.thux.lan. (32)</span><br><span>23:36:44.556049 IP (tos 0x0, ttl 63, id 43435, offset 0, flags [none], proto UDP (17), length 141)</span><br><span> 10.2.201.135.53 > 10.1.201.111.52413: [bad udp cksum 0xa784 -> 0xa739!] 54816 q: MX? dns1b.thux.lan. 0/1/0 ns: thux.lan. SOA a.misconfigured.dns.server.invalid. hostmaster.thux.lan. 2021092801 10800 3600 604800 3600 (113)</span><br><span></span><br><span></span><br><span>failing nslookup via coredns</span><br><span>============================</span><br><span></span><br><span>23:38:24.832545 IP (tos 0x0, ttl 61, id 38473, offset 0, flags [DF], proto UDP (17), length 60)</span><br><span> 10.1.201.111.9411 > 10.2.201.135.53: [udp sum ok] 10465+ A? dns1b.thux.lan. (32)</span><br><span>23:38:24.832545 IP (tos 0x0, ttl 61, id 38474, offset 0, flags [DF], proto UDP (17), length 60)</span><br><span> 10.1.201.111.9411 > 10.2.201.135.53: [udp sum ok] 12060+ AAAA? dns1b.thux.lan. (32)</span><br><span>23:38:24.832941 IP (tos 0x0, ttl 63, id 789, offset 0, flags [none], proto UDP (17), length 60)</span><br><span> 10.2.201.135.53 > 10.1.201.111.9411: [bad udp cksum 0xa733 -> 0x24bd!] 10465 ServFail q: A? dns1b.thux.lan. 0/0/0 (32)</span><br><span>23:38:24.833031 IP (tos 0x0, ttl 63, id 790, offset 0, flags [none], proto UDP (17), length 60)</span><br><span> 10.2.201.135.53 > 10.1.201.111.9411: [bad udp cksum 0xa733 -> 0x1e67!] 12060 ServFail q: AAAA? dns1b.thux.lan. 0/0/0 (32)</span><br><span>23:38:24.833495 IP (tos 0x0, ttl 61, id 38475, offset 0, flags [DF], proto UDP (17), length 60)</span><br><span> 10.1.201.111.9411 > 10.2.201.135.53: [udp sum ok] 10465+ A? dns1b.thux.lan. (32)</span><br><span>23:38:24.833495 IP (tos 0x0, ttl 61, id 38476, offset 0, flags [DF], proto UDP (17), length 60)</span><br><span> 10.1.201.111.9411 > 10.2.201.135.53: [udp sum ok] 12060+ AAAA? dns1b.thux.lan. (32)</span><br><span>23:38:24.833611 IP (tos 0x0, ttl 63, id 791, offset 0, flags [none], proto UDP (17), length 60)</span><br><span> 10.2.201.135.53 > 10.1.201.111.9411: [bad udp cksum 0xa733 -> 0x24bd!] 10465 ServFail q: A? dns1b.thux.lan. 0/0/0 (32)</span><br><span>23:38:24.833648 IP (tos 0x0, ttl 63, id 792, offset 0, flags [none], proto UDP (17), length 60)</span><br><span> 10.2.201.135.53 > 10.1.201.111.9411: [bad udp cksum 0xa733 -> 0x1e67!] 12060 ServFail q: AAAA? dns1b.thux.lan. 0/0/0 (32)</span><br><span>23:38:24.834003 IP (tos 0x0, ttl 61, id 38477, offset 0, flags [DF], proto UDP (17), length 60)</span><br><span> 10.1.201.111.9411 > 10.2.201.135.53: [udp sum ok] 10465+ A? dns1b.thux.lan. (32)</span><br><span>23:38:24.834076 IP (tos 0x0, ttl 63, id 793, offset 0, flags [none], proto UDP (17), length 60)</span><br><span> 10.2.201.135.53 > 10.1.201.111.9411: [bad udp cksum 0xa733 -> 0x24bd!] 10465 ServFail q: A? dns1b.thux.lan. 0/0/0 (32)</span><br><span>23:38:24.834099 IP (tos 0x0, ttl 61, id 38478, offset 0, flags [DF], proto UDP (17), length 60)</span><br><span> 10.1.201.111.9411 > 10.2.201.135.53: [udp sum ok] 12060+ AAAA? dns1b.thux.lan. (32)</span><br><span>23:38:24.834165 IP (tos 0x0, ttl 63, id 794, offset 0, flags [none], proto UDP (17), length 60)</span><br><span> 10.2.201.135.53 > 10.1.201.111.9411: [bad udp cksum 0xa733 -> 0x1e67!] 12060 ServFail q: AAAA? dns1b.thux.lan. 0/0/0 (32)</span><br><span></span><br><span></span><br><span>_______________________________________________</span><br><span>Pdns-users mailing list</span><br><span>Pdns-users@mailman.powerdns.com</span><br><span>https://mailman.powerdns.com/mailman/listinfo/pdns-users</span><br></div></body></html>