<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<font face="Helvetica, Arial, sans-serif">Hi all,<br>
<br>
I've searched pdns docs as well as threads here but can find
nothing about how to deploy ecs or more specifically, under which
circumstance ecs can be used.<br>
<br>
From what I understand of ecs, the recursor will forward the
client's IP with the request to the auth (or intermediate) servers
so that the auth server can respond with a result that is local
(if possible) to the client. I'm going to assume then that a
public address is needed from the client as you can't determine
location info from an rfc1918 address.<br>
<br>
Consider the following setup:<br>
<br>
branch1 (client with private address) -> firewall/NAT+VPN
(branch) -> internet -> firewall/NAT+VPN (head office) ->
recursor -> auth query ...<br>
branch2 </font><font face="Helvetica, Arial, sans-serif">(client
with private address) </font><font face="Helvetica, Arial,
sans-serif">-> firewall/NAT+VPN (branch) |<br>
etc.<br>
<br>
In this scenario, clients at branches have their queries forwarded
over site-to-site VPN tunnels to the recursor at a head office.
The client IP the recursor sees is the client's private IP
address.<br>
<br>
Is there any possibility of getting a design like this to work
with ecs? If not, any alternatives?<br>
<br>
Notes:<br>
<br>
The specific pdns-recursor settings I'm looking at are:<br>
<br>
ends-subnet-allow-list<br>
ecs-add-for<br>
use-incoming-edns-subnet<br>
<br>
Regards, Robby<br>
</font>
</body>
</html>