<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">I am having problems setting up RPZ under PowerDNS Recursor. Here is my setup:<div class=""><br class=""></div><div class="">PowerDNS Recursor 4.7.1</div><div class="">CentOS 7.9</div><div class="">2 servers, primary and secondary.</div><div class=""><br class=""></div><div class="">On the primary server I have the following setup:</div><div class=""><br class=""></div><div class="">recursor.conf includes this line:</div><div class="">lua-config-file=/etc/pdns-recursor/recursorconf.lua</div><div class=""><br class=""></div><div class=""><div class="">recursorconf.lua has:</div><div class="">rpzFile("/etc/pdns-recursor/dynatronsoftware.rpz", {})</div><div class=""><div class=""><br class="webkit-block-placeholder"></div><div class=""><div class="">dynatronsoftware.rpz has:</div><div class="">$TTL 2h;</div><div class="">$ORIGIN <a href="http://domain.dynatronsoftware.com" class="">domain.dynatronsoftware.com</a></div><div class="">@ SOA <a href="http://powerdns.dynatronsoftware.com" class="">powerdns.dynatronsoftware.com</a>. <a href="http://hostmaster.dynatronsoftware.com" class="">hostmaster.dynatronsoftware.com</a> ( 1 12h 15m 3w 2h)</div><div class=""> NS <a href="http://ns1.dynatronsoftware.com" class="">ns1.dynatronsoftware.com</a>.</div><div class="">; begin RPZ RR definitions</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><a href="http://test.dynatronsoftware.com" class="">test.dynatronsoftware.com</a> A 192.168.2.5</div><div class=""><a href="http://dev-forecast.dynatronsoftware.com" class="">dev-forecast.dynatronsoftware.com</a> A 192.168.2.5</div></div><div class=""><br class="webkit-block-placeholder"></div><div class="">The primary works fine. The issue I am having is getting the secondary to work. On this server I have the following setup:</div><div class=""><br class=""></div><div class="">recursor.conf contains:</div><div class="">lua-config-file=/etc/pdns-recursor/recursorconf.lua</div><div class=""><br class=""></div><div class="">recursorconf.lua has:</div><div class="">rpzPrimary("10.20.6.27", "dynatronsoftware.rpz”)</div><div class=""><br class=""></div><div class="">The logs on the second server show this:</div><div class=""><br class=""></div><div class=""><div class="">Aug 1 13:34:02 tst-dyn-dns2 pdns-recursor: msg="Loading RPZ from nameserver" subsystem="rpz" level=1 prio=6 ts="1659378842.989" primary="10.20.6.27" zone="dynatronsoftware.rpz"</div><div class="">Aug 1 13:34:02 tst-dyn-dns2 pdns-recursor: msg="Unable to load RPZ zone, will retry" subsystem="rpz" level=1 prio=4 ts="1659378842.990" exception="AXFR chunk error: Server Failure" from="10.20.6.27" refresh="10” </div><div class="">zone=“dynatronsoftware.rpz"</div></div><div class=""><br class=""></div><div class="">I am not seeing any logs at the same time on the secondary server.</div><div class=""><br class=""></div><div class="">What am I missing in my setup here? Do I need to do something on the primary to allow transfers from the secondary?</div><div class=""><br class=""></div><div class="">Thanks,</div><div class=""><br class=""></div><div class="">
<div dir="auto" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; color: rgb(0, 0, 0); caret-color: rgb(0, 0, 0); word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="font-weight: normal; color: rgb(0, 0, 0);"><br class="Apple-interchange-newline">Luke Miller<br class="">Infrastructure Manager<br class="">O: 972-913-6388</div><div style="font-weight: normal; color: rgb(0, 0, 0);"><br class="">Corporate Office <br class="">2703 Telecom Pkwy, Suite 140A<br class="">Richardson, TX 75082<br class=""><a href="mailto:lmiller@DynatronSoftware.com" class="">lmiller@DynatronSoftware.com</a> | <a href="http://www.dynatronsoftware.com" class="">www.dynatronsoftware.com</a><br class=""></div></div></div><br class="Apple-interchange-newline" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"></span><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"></span><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"></span><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"></span><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"></span><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;"></span><span><img apple-inline="yes" id="BA95FB42-8CCE-4104-AD95-627A549DCD57" src="cid:70B13F61-2C03-4721-BDD4-25A7A845B331" class=""></span>
</div>
<br class=""></div></div></body></html>